Privacy Policy

We believe your data belongs to you. oto minimizes data collection and encrypts sensitive items: your secrets and credentials for third-party tools are encrypted at rest (AES-256-GCM), with the master key kept out of the database, and isolated per user.

The data controller is Otomata, a SASU registered in Marseille (SIREN 106 974 637) — see legal notice. Details of our security measures are published on trust.oto.ninja.

• Ad cookies — No advertising cookies, no ad networks, no retargeting pixel.
• Fingerprinting — We don't use any browser fingerprinting techniques.
• Data selling — Your data is never sold, traded, or shared for commercial purposes.
• No tracker without consent — No audience measurement is active before your explicit agreement.

Account data

Payments

Card details (number, security code) are processed directly by our payment provider (Stancer) and do not pass through our servers.

The essential cookies above are strictly necessary to run the service. Audience measurement: we may measure audience and improve the site using PostHog (hosted in the European Union). This is enabled only after your explicit consent via the dedicated banner; without consent, no audience tracker is set. You can withdraw your consent at any time.

• Scaleway — Hosting, database, storage, secrets management, and transactional email — European Union (France)
• Stancer — Collecting subscription payments; payment institution supervised by the French ACPR — France
• Logto — OAuth 2.0 / PKCE authentication (self-hosted at Scaleway, EU)
• PostHog — Audience measurement, only after consent — European Union
• Sentry — Monitoring and logging of technical errors (may contain personal data) — European Union (Germany)
• Anthropic (Claude) — AI assistant used by the Publisher's team for operations, support, and hands-on services (may occasionally process customer data in that context) — API mode with no training on submitted content; transfers outside the EU covered by standard contractual clauses — United States
• Optional connector services — some connectors (e.g. hosted browser, messaging) rely on third-party services, enabled only if you use them and possibly operating outside the EU (covered by standard contractual clauses); up-to-date list on trust.oto.ninja

In accordance with Article 28 GDPR, a data processing agreement (DPA) governs this processing; it is also available on trust.oto.ninja. Any transfers outside the EU are covered by standard contractual clauses.

• Access — Get a copy of your data
• Rectification — Correct inaccurate data
• Deletion — Have your data erased, on request
• Portability — Get your data in a standard format
• Objection — Object to processing
• Complaint — To the CNIL (French data authority)

To exercise your rights: email alexis@otomata.tech. We respond within 30 days.