Privacy Policy

Privacy officer (Quebec Law 25)

Our designated privacy officer is Melinda Tongdee: melinda@otwmotion.com. Our data is hosted outside Quebec (Cloudflare infrastructure, primarily in the United States) with providers under industry-standard contractual protections. Version française disponible.

What we collect

When you use OTW Signal, we collect:

• Account information: your email address, and · only if you choose to sign in with a password rather than Google, Microsoft, or a one-time emailed link · a securely hashed version of your password (we never store your password in plain text, and we cannot see it). If you sign in with Google or Microsoft, we also store the display name and profile picture your account provides, so we can show them back to you; we never request access to your contacts, calendar, files, posts, or advertising data from either provider.
• Business information you provide: the business name, website URL, description, and any custom test questions you enter.
• Data crawled from the website you submit: publicly visible information already on that site (page titles, meta descriptions, structured data, headings). We only crawl the URL you provide, not other sites, and not anything behind a login.
• AI engine responses: the actual text returned by AI assistants when we test the questions you've set up. This is stored so the report can show you exactly what was said.
• Payment information: handled entirely by Stripe. We never see or store your card number; we only receive confirmation that a payment succeeded or a subscription is active.
• Feedback you choose to give us: an NPS score and/or free-text comments, if you submit them.
• Basic technical data: standard web request information (like IP address) collected automatically by Cloudflare, our hosting provider, for security and performance purposes.

Your email is also tied to your purchase history and report history, so you can return later and see previous reports rather than losing access to something you paid for.

Why we collect it

We use this information to:

• Generate and deliver the report you paid for.
• Let you access your previous reports and purchase history if you return later.
• Notify you if a report you own can be refreshed or has meaningfully changed.
• Process payments securely through Stripe.
• Improve the product based on aggregate usage and feedback.
• With your consent, send you occasional updates about the product or related offerings (see Marketing Communications below).

What we don't do

• We don't sell your data to anyone.
• We don't share your business information with other OTW Signal customers.
• We don't use your data to train AI models.

Who we share data with

To operate the product, some data necessarily passes through these third parties:

• OpenAI: receives the test questions you configure, in order to generate the AI-engine responses your report is based on.
• Stripe: receives your payment details directly (we never see them) to process one-time payments and subscriptions.
• Cloudflare: hosts our infrastructure (servers, database) and provides standard web security.
• Google or Microsoft: only if you choose "Continue with Google" or "Continue with Microsoft" to sign in. We receive your email address, display name, and profile picture from whichever one you pick · nothing else, and never your contacts, calendar, files, posts, or advertising accounts.
• Resend: delivers transactional email on our behalf · your report (as a backup if the page is slow), and the one-time sign-in link if you choose "Continue with email." Resend sees the recipient address and message content of these emails; it doesn't see anything else about your account.
• Google Analytics: only if you accept cookies. We use Google Analytics 4 to understand how the site is used (pages visited, approximate location, device and browser type, and actions like starting a report), which Google processes on our behalf. We never send it your name, email, or payment details.

Each of these companies has its own privacy policy governing how they handle data on their end.

Marketing communications

With your explicit consent, given through a clearly labeled opt-in checkbox at signup (never pre-checked, and never a condition of using the product), we may send you:

• Product updates and new feature announcements.
• AI visibility insights and educational content.
• Occasional promotions.
• Reminders that a report you own can be refreshed.

You can withdraw this consent at any time by clicking unsubscribe in any marketing email, or by contacting us using the email below. Withdrawing marketing consent never affects your ability to use the product, access your reports, or receive transactional emails (like report delivery or payment receipts), which are not marketing and are sent regardless of this setting.

Cookies and analytics

We use one functional cookie to keep you logged in between visits. It doesn't track you across other websites.

For analytics, we use Google Analytics 4 (GA4) to measure how the site is used so we can improve it. GA4 sets cookies, but only after you accept them. On your first visit a banner lets you accept or decline. Until you accept, analytics cookies stay disabled: we use Google Consent Mode, so nothing cookie-based runs without your consent. You can change your choice at any time by clearing your browser's stored site data for otwmotion.com, or install Google's browser opt-out add-on. We never use advertising or cross-site tracking cookies.

Data inventory: what, why, where, and for how long

Deleting your data (self-serve)

From your account page you can, without emailing anyone:

• Export your data as a JSON file containing your account details, businesses, reports, prompts, payment history, and subscriptions.
• Delete one business's data: its reports, raw AI answers, crawled pages, and profile details are permanently removed.
• Delete your whole account: everything above for every business, plus your sign-in credentials and sessions. Payment transaction records are kept in anonymized form (no name, no email) because Canadian tax law requires us to retain them.

Deletion is immediate and permanent. If you have an active subscription we ask you to cancel it first, so you are never billed after deleting.

Lawful bases for processing (GDPR)

For visitors and customers in the European Economic Area and the UK, we process personal data on these bases:

• Performance of a contract: your account, running the reports you purchase, delivering them by email, and providing the dashboard and API you subscribe to.
• Consent: analytics cookies (only after you accept the banner) and marketing emails (only if you tick the box; withdrawable anytime via the unsubscribe link or your account).
• Legitimate interests: preventing fraud and abuse (rate limiting, bot checks), securing the service, and improving it using aggregate, non-identifying information.
• Legal obligation: retaining payment transaction records for tax purposes.

International transfers: our infrastructure providers (Cloudflare, Stripe, Resend, Google) may process data outside your country, including in the United States, under their standard contractual clauses and equivalent safeguards. See also the Quebec-specific note in our French policy.

Your rights

You can access, correct, export, or delete the personal data we hold about you at any time, using the self-serve tools above or by contacting our privacy officer (below). We respond to requests we cannot automate as soon as we reasonably can, and in any case within 30 days. If you are in the EEA or UK, you also have the rights to data portability, to object to processing based on legitimate interests, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority. In Canada, you may complain to the Office of the Privacy Commissioner; in Quebec, to the Commission d'accès à l'information.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page.

Contact

Questions about this policy or your data: support@otwmotion.com