Billing ledger and automated holds
We retain Stripe order identifiers, amounts, currency, tax, fees, refund, cancellation and dispute status; aggregate paid usage and its source; and the policy version and acceptance time. We use this for reconciliation, refund eligibility, fraud and dispute handling, tax, and accounting. The ledger contains no full card number, sentence text, or raw processing prompt. Stripe and Stripe Tax process payments and tax; Supabase stores application records; Vercel hosts the service and routes evaluation requests; language-model providers process practice content. Refund or dispute holds are automated, while policy exceptions remain manually reviewed. On account deletion, ordinary product data is deleted or anonymized and the user reference in retained minimal financial records may be removed. Contact support to ask about your records and retention basis.
1. Overview
This Privacy Policy explains how Otonna (“we”, “us”) collects, uses, shares, and protects personal information when you use the Otonna website and application (the “Service”). By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
2. Information We Collect
We collect: (a) account information from Google or Apple, or the email address you use for one-time-code sign-in, via Supabase Auth; this may include your email address, name, and profile image; (b) practice content you enter, including the English sentences and rewrites you submit; (c) usage data, such as practice sessions, saved library patterns, credit balances, and interface-language preference; (d) limited technical data, such as IP address and request metadata used for security and rate limiting; and (e) billing data handled by Stripe. We do not collect or store payment card numbers ourselves.
3. How We Use Your Information
We use your information to create and maintain your account; provide the five-level practice experience and generate feedback; store your saved patterns and credit balances; process purchases and manage subscriptions; enforce rate limits and prevent abuse or fraud; provide support; comply with legal obligations; and review and improve evaluation quality. We do not sell your personal information, and we do not use it for third-party advertising.
4. Legal Bases for Processing (EEA/UK)
Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you (to provide the Service and process payments); our legitimate interests (to secure the Service, prevent abuse, and improve quality); your consent (for example, when you actively rate an evaluation so we may store that snapshot); and compliance with legal obligations.
5. Automated Processing of Your Submissions
To generate feedback, evaluations, and sentence patterns, the text you submit is sent through the Vercel AI Gateway to a large-language-model provider, which processes it to return a result. We select providers that we understand do not use API submissions to train their public models by default, but their handling is governed by their own terms. Please do not submit sensitive personal information in practice text.
6. Third-Party Processors and Payments
We rely on service providers that process data on our behalf: Supabase (database hosting and authentication), Resend (delivery of sign-in codes), Vercel and its AI Gateway together with the underlying model provider (application hosting and automated processing), Google and Apple (optional sign-in), and Stripe (payments). Stripe collects and processes your payment details directly under its own privacy policy; we receive only limited billing metadata such as subscription status and a transaction identifier, not full card numbers.
7. Data Retention
We keep account data for as long as your account exists. Practice submissions are not stored as long-term history; however, when you actively rate an evaluation as fair or unfair, we retain a snapshot of that submission and the related feedback to review and improve quality. Billing records may be retained as required by law, such as for tax and accounting. When you delete your account, we delete or anonymize associated data except where retention is legally required.
8. Data Security
We use measures such as encrypted HTTPS connections, database row-level security, and access controls to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your sign-in credentials protected.
9. Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can permanently delete your account and associated data at any time from the Account page. To exercise other rights, contact us at support@otonna.com. If you are in Canada you may also contact the Office of the Privacy Commissioner; if you are in the EEA or UK, your local supervisory authority.
10. International Data Transfers
We and our providers may process and store your information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for such transfers. By using the Service, you understand that your information may be processed in these locations.
11. Cookies and Similar Technologies
We use strictly necessary cookies and similar technologies to keep you signed in and to operate the Service, such as session and authentication cookies. We do not use advertising or cross-site tracking cookies.
12. Children’s Privacy
The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us so we can delete it.
13. Changes and Contact
We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “last updated” date and, where appropriate, additional notice. For any privacy question or request, contact support@otonna.com.
14. Language
Translations of this document are provided for convenience only. In case of any discrepancy between language versions, the English version prevails.
