Privacy notice.

We collect account identifiers, authentication records, contact details, pilot application information, support communications, API-key metadata, product usage, verdict and latency telemetry, and repository-scan findings you ask us to process.

If you connect GitHub, we receive the account and repository information permitted by the scopes you approve. Access tokens are used to perform requested operations and are stored in encrypted form where persistence is required.

The runtime inspection endpoint processes submitted prompts, model output, tool calls, and metadata in request memory. Raw runtime content is not written to the application database; aggregate verdicts, finding-category counts, latency, and request identifiers are retained for product telemetry.

Repository scanning is different: it may store file paths, dependency metadata, findings, and short evidence excerpts so you can review a report. Do not submit content you are not authorized to process.

We use information to authenticate users, operate and secure the service, perform requested inspections and scans, qualify and support pilots, troubleshoot incidents, measure reliability, prevent abuse, communicate about the service, and comply with legal obligations.

We use infrastructure and processing providers such as Supabase, Cloudflare, GitHub, and—when an AI-assisted feature is invoked—Anthropic. They process information for us under their applicable service terms. We may also disclose information when required by law, to protect the service or others, or in connection with a corporate transaction.

We do not sell personal information or use customer content for third-party behavioral advertising.

We retain account and product records while an account or pilot is active and afterward only as reasonably necessary for security, support, contractual, and legal purposes. Pilot applications that do not proceed may be removed after the qualification period. You may request deletion; some records may be retained where required for fraud prevention, legal compliance, or dispute resolution.

We use access controls, scoped credentials, row-level database security, transport encryption, secret redaction, and operational monitoring appropriate to the service. No system is perfectly secure, and OTONOMI cannot guarantee that unauthorized access will never occur.

You may disconnect integrations, revoke API keys, stop submitting content, or request access, correction, or deletion of personal information. Depending on where you live, local law may provide additional rights. We will verify requests before acting on them and will not discriminate for exercising applicable privacy rights.

OTONOMI is intended for business users and is not directed to children under 13. Information may be processed in countries other than the one where you live, subject to applicable safeguards and provider terms.

We may update this notice as the product and our practices change. Material changes will be posted here with a new effective date.

Privacy questions and requests: hello@otonmi.com.