Privacy Policy

Scope

This Privacy Policy covers ootto.ai and the Ootto for Content product, reachable at content.ootto.ai and ootto.ai/content — the paid Instagram business operator, its dashboard, and its Claude/MCP connector — not just the marketing website.

Information we collect

We keep data collection to what the product needs to run. Depending on how you use Ootto, we collect:

• Account information — the email address and authentication data you provide to sign up or sign in, including basic profile information from Google if you sign in with Google.
• Billing information — your subscription plan and payment status. Your card details are collected and processed directly by Paddle, our payment processor and merchant of record; we do not receive or store your full card number.
• Instagram connection data — when you connect an Instagram account, we and our service providers receive an OAuth access token and the account data that connection permits: profile info, media, and comments, plus the ability to reply to comments, send direct messages, and publish content on your behalf for the actions you enable.
• Brand and business information — the website, brand voice, audience, niche, products, and any other notes you provide while onboarding or editing your brand profile.
• Content you upload or that Ootto generates — images or footage you upload, and the reels, scripts, captions, and content calendar Ootto produces for your account.
• Leads — when your connected Instagram account receives a comment, we may capture the commenter's handle, a short snippet of their comment, and a link to the post so it can be shown to you as a lead.
• Claude/MCP connector activity — if you use the Ootto MCP connector, we store a connection key tied to your account and log the requests made through it.
• Scheduling information — when you book a demo, the name, email, and time you enter go to our scheduling provider (Google Calendar or Cal.com, depending on where you book) to create the appointment.
• Usage data — privacy-friendly product analytics about how visitors and customers use the site and app (pages viewed, events such as form submissions), which may include IP address, browser type, and referring page.
• Technical data — standard server and error-monitoring logs.

How we use your information

• To provide the product: run the Instagram operator you configure, generate and store your brand profile and reels, and surface leads captured from your connected account.
• To process payments and manage your subscription, trial, and credit balance.
• To authenticate you and secure your account, including the Claude/MCP connector key.
• To contact you, schedule and run product demos, and respond to your requests.
• To send you product updates you have asked for.
• To measure and improve the website and the product.
• To detect, prevent, and address technical issues and abuse.

Third-party services

We rely on a limited set of service providers, each of which processes data under its own privacy policy:

• Supabase — authentication and application database.
• Paddle — payment processing, subscription billing, and merchant of record.
• Composio — brokers the Instagram (Meta) OAuth connection and the API calls your connected account authorizes.
• Meta / Instagram — the platform your connected account belongs to; we only receive Instagram data through the permissions you grant during that connection.
• Anthropic (Claude) — powers brand-profile generation, the in-app assistant, and reel scripting.
• Runway — used by our reel-rendering engine to generate certain images inside your reels.
• Vercel — application hosting.
• Sentry — error monitoring.
• PostHog — privacy-friendly product analytics.
• Google Calendar / Cal.com — demo scheduling.

Cookies and tracking

We use cookies and similar technologies for authentication (keeping you signed in), essential site functionality, and analytics. You can control cookies through your browser settings, though blocking authentication cookies will prevent you from staying signed in.

Data retention

We keep account, billing, brand, and lead data for as long as your account is active, and for a reasonable period afterward as needed for legal, tax, security, or dispute-resolution purposes. If you disconnect an Instagram account or revoke a connector key, we stop using it going forward; already-generated reels, captured leads, and billing records are not automatically deleted. Email us to request deletion of specific data or your account.

Your rights

You can request access to, correction of, or deletion of your personal information, or ask us to revoke a specific Instagram connection or MCP key, at any time by emailing us at hello@ootto.ai.

Security

We take reasonable measures to protect your information — including relying on our providers' own security controls for authentication, payments, and hosting — but no method of transmission or storage is completely secure.

Changes to this policy

We may update this policy from time to time. We will post the new version here with an updated date.

Contact

Questions? Email us at hello@ootto.ai.