Privacy Policy — otoreply

Last updated:

This Privacy Policy explains how (“otoreply,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the otoreply mobile application, website, and related services (collectively, the “Service”). Please read it carefully. By using the Service you agree to the practices described here.

1. Who we are

otoreply is a platform that lets businesses create a single “verified page” — a shareable link (and QR code) that holds their business profile, catalog/menu, custom links, and connected social accounts. The Service is provided by .

For any privacy question or request, contact us at .

2. Information we collect

2.1 Information you provide

Account information: your name, email address, phone number, and password (passwords are stored only as secure hashes by our authentication provider).
Business/profile information: business name, handle, description, address, logo and cover images, business category, and country.
Content you create: catalogs, categories, items, prices, custom links, additional contact details, and theme/appearance settings.
Verification data: one-time passcodes (OTP) sent to your phone or email to verify ownership, and website domain-verification tokens.
Support communications: information you provide when you contact us or submit an inquiry (e.g. an Enterprise/contact-sales request).

2.2 Information from connected third-party accounts (e.g. Instagram)

If you choose to connect a social account such as Instagram, we access only the information you authorize through that platform’s official login and permissions. For Instagram (via Instagram’s API with Instagram Login) this may include:

Your Instagram account ID, username, display name, and profile picture.
Your recent media (posts) — captions, media URLs, thumbnails, and timestamps — when you enable post sync.
Comments on your posts and direct messages to your account, and the ability to reply, only when you enable the automation feature and only to operate the auto-reply rules you configure.
An access token issued by the platform, stored securely and used solely to perform the actions you authorized.

We use your connected-account data only to provide the features you turn on (showing your accounts/posts on your page, and running the auto-reply rules you create). We do not sell this data, use it for advertising, or share it except as described in this policy. You can disconnect a connected account at any time (see “Your choices”).

2.3 Information collected automatically

Usage and analytics: aggregate page-view counts for your public page, and basic app-usage events used to operate and improve the Service.
Device and log data: device type, operating system, app version, IP address, and diagnostic/crash logs.
Approximate/precise location: only if you use the in-app location picker to set your business address (via device location or map selection). We do not track your location in the background.
Cookies / local storage (web): used to keep you signed in and remember preferences. See “Cookies.”

3. How we use information

To create and manage your account and business page.
To provide the features you use — catalog, links, QR code, connected accounts, post sync, and comment/DM automation.
To verify ownership of phone numbers, email addresses, and website domains.
To display your public page and its analytics to you.
To process subscriptions and record billing intent (payment processing, when enabled, is handled by a third-party payment provider).
To communicate with you about the Service, security, and support.
To detect, prevent, and address fraud, abuse, and security issues.
To comply with legal obligations.

4. Legal bases for processing (EEA/UK)

Where applicable law (such as the GDPR) requires it, we rely on the following legal bases:

Performance of a contract — to provide the Service you signed up for.
Consent — for optional features you enable, such as connecting a social account or automation. You may withdraw consent at any time.
Legitimate interests — to secure, maintain, and improve the Service.
Legal obligation — to comply with applicable laws.

5. How we share information

We do not sell your personal information. We share information only as follows:

Publicly, by your choice: content you publish on your public page (business profile, catalog, links, connected accounts) is visible to anyone with the link or QR code. Do not put anything on your public page you don’t want to be public.
Service providers (processors): vendors who process data on our behalf under contract, including:
- Supabase (database, authentication, storage, serverless functions / hosting).
- Google Firebase (backend services) and Google Maps Platform (location/geocoding).
- Google Fonts (font delivery).
- Meta Platforms / Instagram (only for the connected-account features you enable).
- A payment provider (only when billing is enabled).
Legal and safety: when required by law, legal process, or to protect the rights, safety, and security of users, the public, or us.
Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

6. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service. Some records are kept longer where required for legal, accounting, or security purposes. Certain operational data is retained for limited periods — for example, automation activity logs are kept for approximately 60 days, and synced social posts reflect only your most recent posts. When you delete your account or data, we delete or de-identify it within a reasonable period, except where retention is legally required.

7. Data deletion & your choices

7.1 Managing your data in the app

Edit or remove your business profile, catalog, links, and contacts at any time.
Disconnect a connected social account (e.g. Instagram) to stop all access and revoke automation. You can also revoke access from your Instagram/Meta account settings.
Disable or delete automation rules at any time.
Unpublish your public page so it is no longer publicly visible.

7.2 Deleting your account and data

To request deletion of your account and associated personal data, use the in-app account controls where available, or email with the subject “Data Deletion Request.” We will verify your identity and delete your data within a reasonable time, except where we must retain it to comply with legal obligations. For automated processing, our data-deletion endpoint is available at .

7.3 Privacy rights

Depending on where you live (e.g. under the GDPR or the CCPA/CPRA), you may have the right to access, correct, delete, or port your personal information, to restrict or object to certain processing, and to withdraw consent. California residents have the right not to receive discriminatory treatment for exercising these rights, and we do not sell or “share” personal information as those terms are defined under California law. To exercise any right, contact .

8. Security

We use industry-standard safeguards to protect your data, including encryption in transit (HTTPS/TLS), access controls, row-level security in our database, and secure storage of access tokens. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

9. International data transfers

Your information may be processed and stored in countries other than your own, including where our service providers operate. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

10. Children’s privacy

The Service is intended for businesses and users aged 18 and over (and not below the age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

11. Cookies and similar technologies

On the web, we use cookies and local storage to keep you signed in and remember preferences. We do not use them for cross-site advertising. You can control cookies through your browser settings; disabling them may affect sign-in and some features.

12. Third-party platform terms

Features that connect to third-party platforms are also governed by those platforms’ own terms and policies, including Instagram’s Privacy Policy and Meta’s Privacy Policy. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date. Material changes will be communicated through the Service where appropriate.

14. Contact us

If you have questions or requests regarding this Privacy Policy or your data, contact us at:

Email:
Entity: