Privacy Policy

Privacy officer (Quebec Law 25)

Our designated privacy officer is Melinda Tongdee: melinda@otwmotion.com. Our data is hosted outside Quebec (Cloudflare infrastructure, primarily in the United States) with providers under industry-standard contractual safeguards. Version française disponible.

What we collect

When you use OTW Signal, we collect:

• Account information: your email address, and · only if you choose to sign in with a password rather than Google, Microsoft, or a one-time emailed link · a securely hashed version of your password (we never store your password in plain text, and we cannot see it). If you sign in with Google or Microsoft, we also store the display name and profile picture your account provides, so we can show them back to you. Signing in never gives us access to your contacts, calendar, files or email. Anything more, such as Google Search Console or a social media account, is a separate connection you choose to make, described below.
• Business information you provide: the business name, website URL, description, and any custom test questions you enter.
• Data crawled from the website you submit: publicly visible information already on that site (page titles, meta descriptions, structured data, headings). We only crawl the URL you provide, not other sites, and not anything behind a login.
• AI engine responses: the actual text returned by AI assistants when we test the questions you've set up. This is stored so the report can show you exactly what was said.
• Payment information: handled entirely by Stripe. We never see or store your card number; we only receive confirmation that a payment succeeded or a subscription is active.
• Feedback you choose to give us: an NPS score and/or free-text comments, if you submit them.
• Google Search Console data, if you connect it: see Google and YouTube API Data below.
• Social media accounts you connect, and the posts you plan: see Social accounts below.
• Basic technical data: standard web request information (like IP address) collected automatically by Cloudflare, our hosting provider, for security and performance purposes.

Your email is also tied to your purchase history and report history, so you can return later and see previous reports rather than losing access to something you paid for.

Why we collect it

We use this information to:

• Generate and deliver the report you paid for.
• Let you access your previous reports and purchase history if you return later.
• Notify you if a report you own can be refreshed or has meaningfully changed.
• Process payments securely through Stripe.
• Improve the product based on aggregate usage and feedback.
• With your consent, send you occasional updates about the product or related offerings (see Marketing Communications below).

What we don't do

• We don't sell your data to anyone.
• We don't share your business information with other OTW Signal customers.
• We don't use your data to train AI models.

Who we share data with

To operate the product, some data necessarily passes through these third parties:

• The AI assistants we measure (OpenAI, Google, Anthropic and Perplexity, depending on which ones your report or Console includes): receive the test questions, in order to produce the answers your report is based on. Some questions are written from your website or from your Search Console searches.
• AI providers that write for you (OpenAI, Anthropic, Google, Groq and Cloudflare Workers AI): receive the text a feature needs, such as your business profile, your website's public content, your Search Console data for Ask Signal and action plans, or the short brief you give for a social post.
• Search data providers (DataForSEO, SerpApi, Brave Search): receive search terms related to your business, to read search results, AI Overviews and search suggestions.
• Social platforms you connect (for example Instagram, Facebook, Threads, YouTube, LinkedIn, X, Bluesky, Mastodon, Telegram, Discord, LINE): receive the posts, photos and videos you schedule for them, at the time you choose.
• Stripe: receives your payment details directly (we never see them) to process one-time payments and subscriptions.
• Cloudflare: hosts our infrastructure (servers, database) and provides standard web security.
• Google or Microsoft: only if you choose "Continue with Google" or "Continue with Microsoft" to sign in. Signing in gives us your email address, display name and profile picture. Google Search Console and YouTube are separate connections, described below.
• Resend: delivers transactional email on our behalf · your report (as a backup if the page is slow), and the one-time sign-in link if you choose "Continue with email." Resend sees the recipient address and message content of these emails; it doesn't see anything else about your account.
• Google Analytics: only if you accept cookies. We use Google Analytics 4 to understand how the site is used (pages visited, approximate location, device and browser type, and actions like starting a report), which Google processes on our behalf. We never send it your name, email, or payment details.

Each of these companies has its own privacy policy governing how they handle data on their end.

Google and YouTube API Data

OTW Motion's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This section covers the four ways OTW connects to Google: signing in with Google, Google Search Console (in OTW Signal), Google Analytics (for the visits your social posts send you) and YouTube (in OTW Motion Social). Each is optional and started by you.

What Google data we may access

• Signing in with Google: your email address, display name and profile picture (the openid, email and profile permissions), to create and identify your OTW account.
• Google Search Console (read-only, webmasters.readonly): for the website you choose, the searches people made before seeing or clicking your site, with their clicks, impressions, click-through rate and average position, and the same figures for your pages, by day, for up to the last 16 months.
• YouTube (youtube.upload and youtube.readonly): the identifier, name, handle and picture of the channel you connect; its subscriber and video counts; and the views, likes and comment counts of the videos OTW uploaded for you. Uploading is what lets us publish the videos you choose. Until Google has finished reviewing OTW Motion Social, the videos we upload for you stay private on YouTube.
• Google Analytics (read-only, analytics.readonly): the list of Google Analytics properties your account can read, so you can choose your website's, and, for that property, the number of visits and key events that came from links OTW posted for you (those tagged utm_campaign=otw_social), by network and by post. We do not read any other Google Analytics data.
• Tokens: the OAuth access and refresh tokens Google issues when you connect, so the connection keeps working without asking you to sign in each time.

How we use it

• To authenticate the connection and keep it working.
• To identify and show you which YouTube channel or Search Console property is connected.
• To upload, at the time you choose, the videos you add to a post and schedule or publish. We do not edit or delete videos already on your channel, and we never post anything you did not schedule or publish.
• To show your Search Console searches and pages in the Console, and to suggest measurement questions from them (searches containing your brand name are left out). Those questions are then asked of the AI assistants we measure for you.
• To answer your questions in Ask Signal and write your action plans, which uses the relevant Search Console searches and pages.
• To show, in OTW Motion Social's Analytics, how many visits each network and each post sent to your website. Each link we post carries a tag naming the network and the post, so your Google Analytics can count them.

Limited use. We use Google user data only to provide or improve the features you see and ask for. We do not sell it and do not use it for advertising.

Storage

• All of it is stored on Cloudflare's infrastructure, encrypted at rest by Cloudflare.
• Google Analytics figures are not stored: we read them when you open Analytics. Its refresh token is encrypted with our own key before it is stored.
• YouTube tokens are also encrypted with our own key before they are stored, and are opened only at the moment we upload or read on your behalf.
• For Search Console we keep the refresh token Google gives us, under Cloudflare's encryption at rest. We never keep the short-lived access token.
• We keep the YouTube channel's identifier, name, handle and picture so you can see which channel is connected, and the daily subscriber and video counts and per-video figures so you can see results over time.

Sharing

• We do not sell Google user data.
• Cloudflare hosts and stores it for us.
• For Ask Signal and action plans, the relevant Search Console searches and pages are sent to OpenAI, which writes the answer.
• Measurement questions written from your Search Console searches are asked of the AI assistants we measure (OpenAI, Google, Anthropic and Perplexity, depending on which ones your Console includes).
• Google Analytics data is not shared with anyone and is not sent to any AI provider.
• YouTube data is not shared with anyone else. Your videos go to YouTube itself, because publishing them is what you asked for.

Retention

• YouTube tokens are kept while the channel is connected, and deleted when you disconnect it or delete the business or your account.
• The Google Analytics token is kept while Google Analytics is connected, and deleted when you disconnect it or delete the business or your account.
• The Search Console refresh token is kept until you disconnect Search Console from your account. Disconnecting it from a single business, or deleting your OTW account, does not delete it today; email melinda@otwmotion.com and we will, or revoke it at Google (below), which stops it working.
• YouTube channel details and figures are kept while the business exists in OTW, and deleted when you delete the business or your account.
• Search Console figures shown in the Console are kept until you disconnect Search Console from that business.
• Some Search Console data is kept after you disconnect or delete: searches saved for writing measurement questions, the evidence saved with Ask Signal answers and action plans, and measurement questions in our research panel. The research panel is a cross-brand record we use to improve how we measure; it never stores the AI answers themselves, and when you delete a business we remove your brand and business from its rows, but the question text stays.

Disconnecting, revoking and deleting

• Disconnect YouTube in OTW Motion Social (Accounts, then Remove): this deletes the tokens we hold and cancels the posts scheduled for that channel. Videos already published stay on YouTube.
• Disconnect Google Analytics in OTW Motion Social (Analytics, then Disconnect): this deletes the token we hold.
• Disconnect Search Console in the Console: this stops new reads; disconnecting it from your account deletes the refresh token we hold.
• Revoke at Google: disconnecting in OTW deletes our copy of the tokens. To withdraw the permission on Google's side as well, use your Google Account permissions.
• Delete: deleting a business or your whole account from your account page removes its YouTube connection, tokens, channel details, posts, uploaded videos and figures. For anything else, or to ask us to delete data, email our privacy officer at melinda@otwmotion.com.

AI

• We do not use Google user data to train general-purpose AI models.
• We do not use Google APIs or Google user data to create, facilitate or distribute AI-generated non-consensual intimate imagery. OTW does not generate images or video.
• Where AI is used with Google user data (Ask Signal, action plans and measurement questions, described above), it is to provide a feature you asked for.

By connecting YouTube you agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.

Social accounts

If you use Social, you can connect accounts on platforms such as Instagram, Facebook, Threads, YouTube, LinkedIn, X, Bluesky, Mastodon, Telegram, Discord and LINE. For each one:

• What we store: the sign-in the platform gives us (an access token, app password, bot token or webhook), encrypted with our own key before it is saved. We also store the account's name, handle and picture, and its follower and post counts where the platform provides them.
• What we post: only the posts you or your team write, approve or schedule, at the time you choose, or when you press Post now. Accounts you mark "by hand" are never posted to by us.
• What we read back: the link to each published post, and its likes, reposts, replies and, for YouTube, views.
• Your posts, photos and videos: stored on Cloudflare until you remove them or delete the business.
• AI writing: if you use Write with AI or Posts from your website, your brief, or your website's public content, is sent to an AI provider (Anthropic, or Google if Anthropic is unavailable) to write drafts. Nothing is posted until you choose to.
• Disconnecting: removing an account deletes the sign-in we hold and cancels its scheduled posts. Posts already published stay on the platform. You can also remove OTW's access in the platform's own settings.

Marketing communications

With your explicit consent, given through a clearly labeled opt-in checkbox at signup (never pre-checked, and never a condition of using the product), we may send you:

• Product updates and new feature announcements.
• AI visibility insights and educational content.
• Occasional promotions.
• Reminders that a report you own can be refreshed.

You can withdraw this consent at any time by clicking unsubscribe in any marketing email, or by contacting us using the email below. Withdrawing marketing consent never affects your ability to use the product, access your reports, or receive transactional emails (like report delivery or payment receipts), which are not marketing and are sent regardless of this setting.

Cookies and analytics

We use one functional cookie to keep you logged in between visits. It doesn't track you across other websites.

For analytics, we use Google Analytics 4 (GA4) to measure how the site is used so we can improve it. GA4 sets cookies, but only after you accept them. On your first visit a banner lets you accept or decline. Until you accept, analytics cookies stay disabled: we use Google Consent Mode, so nothing cookie-based runs without your consent. You can change your choice at any time by clearing your browser's stored site data for otwmotion.com, or install Google's browser opt-out add-on. We never use advertising or cross-site tracking cookies.

Data inventory: what, why, where, and for how long

Deleting your data (self-serve)

From your account page you can, without emailing anyone:

• Export your data as a JSON file containing your account details, businesses, reports, prompts, payment history, and subscriptions.
• Delete one business's data: its reports, raw AI answers, crawled pages, and profile details are permanently removed.
• Delete your whole account: everything above for every business, plus your sign-in credentials and sessions. Payment transaction records are kept in anonymized form (no name, no email) because Canadian tax law requires us to retain them.

What deletion does not remove: Google Search Console searches already saved for writing measurement questions, the evidence saved with Ask Signal answers and action plans, and measurement questions in our research panel (with your brand and business removed). See Google and YouTube API Data.

Deletion is immediate and permanent. If you have an active subscription we ask you to cancel it first, so you are never billed after deleting.

Lawful bases for processing (GDPR)

For visitors and customers in the European Economic Area and the UK, we process personal data on these bases:

• Performance of a contract: your account, running the reports you purchase, delivering them by email, and providing the dashboard and API you subscribe to.
• Consent: analytics cookies (only after you accept the banner) and marketing emails (only if you tick the box; withdrawable anytime via the unsubscribe link or your account).
• Legitimate interests: preventing fraud and abuse (rate limiting, bot checks), securing the service, and improving it using aggregate, non-identifying information.
• Legal obligation: retaining payment transaction records for tax purposes.

International transfers: our infrastructure providers (Cloudflare, Stripe, Resend, Google) may process data outside your country, including in the United States, under their standard contractual clauses and equivalent safeguards. See also the Quebec-specific note in our French policy.

Your rights

You can access, correct, export, or delete the personal data we hold about you at any time (with the exceptions listed under Deleting your data), using the self-serve tools above or by contacting our privacy officer (below). We respond to requests we cannot automate as soon as we reasonably can, and in any case within 30 days. If you are in the EEA or UK, you also have the rights to data portability, to object to processing based on legitimate interests, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority. In Canada, you may complain to the Office of the Privacy Commissioner; in Quebec, to the Commission d'accès à l'information.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page.

Contact

Questions about this policy or your data: support@otwmotion.com