Last updated: October 22, 2026
Otto AI ("Otto," "we," "our," or "us") provides business, financial, accounting, tax, document management, communication, and AI-assisted services through our website, mobile application, and related products. We refer to these products together as the "Services."
This Privacy Policy explains what information we collect, how we collect and use it, when it is shared, how long it is retained, and the choices available to you.
The information we collect depends on the features you use.
Payment-card transactions may be handled by third-party payment providers. Otto does not store complete raw payment-card numbers unless expressly stated at the point of collection.
Where identity verification is required, we may collect:
We request consent where required before collecting or processing identity-verification information.
When you connect a third-party account or integration, we may receive information authorized by you from:
The information received depends on the permissions you grant to the connected service.
We may automatically collect:
We do not use this information for third-party behavioral advertising.
We collect information:
We may use information to:
We do not sell personal information or use personal information for third-party behavioral advertising.
Otto uses Amazon Web Services ("AWS") Bedrock to run the models that support Otto's AI features. We use AWS Bedrock for this purpose only.
AWS Bedrock is used only when you choose to use an AI-powered feature. It is not used for ordinary transactions, payments, account management, or other non-AI functionality.
When you choose to use an AI feature, Otto may send the following information to AWS Bedrock:
This information is used only to provide the AI feature you requested, such as:
Before Otto sends personal information to AWS Bedrock, the application presents a disclosure identifying AWS Bedrock, explaining the categories of information that may be sent, and requesting your permission.
You may choose Not Now and continue using non-AI portions of the Services.
You may withdraw permission at any time through:
Settings > AI Data Sharing > Withdraw Permission
After permission is withdrawn, Otto will not send new information to AWS Bedrock unless you provide permission again. Withdrawing permission does not affect processing that occurred before withdrawal.
Otto does not use personal information submitted through AI features to train publicly available artificial-intelligence models.
AWS processes information submitted through Amazon Bedrock as a service provider working on Otto's behalf. Its processing is governed by Otto's AWS configuration and contractual terms.
Responses produced by these features may be incomplete or inaccurate. They are intended to assist with tasks and provide information. They are not a substitute for advice from a qualified financial, accounting, tax, or legal professional.
Please review any response before relying on it or using it to make an important decision.
We may share information only as described below.
We may share information with service providers that perform services on our behalf, including:
These providers may access information only as necessary to perform services for Otto. They are contractually required to protect personal information and provide the same or an equivalent level of protection described in this Privacy Policy.
We share information with third-party services when you request or authorize an integration. Your use of a connected service may also be governed by that service's privacy policy.
We may disclose information when reasonably necessary to:
If Otto is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, information may be transferred as part of that transaction.
Any recipient will be required to handle personal information consistently with this Privacy Policy and applicable law.
We may share information for another purpose when we clearly explain the purpose and obtain your permission where required.
Our websites may use cookies and similar technologies for:
Otto does not use cookies or personal information for third-party behavioral advertising or cross-context behavioral advertising.
You may manage cookies through your browser or device settings. Disabling necessary cookies may prevent portions of the Services from functioning properly.
We retain information only for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Privacy Policy, meet legal obligations, resolve disputes, and enforce agreements.
Our general retention periods include:
Information may remain temporarily in encrypted backups until those backups are overwritten through our standard backup cycle.
We may retain de-identified information that can no longer reasonably be associated with you.
You may initiate account deletion from within the application through:
Settings > Delete Account
You may also contact us at privacy@joinotto.com.
We may request information necessary to verify your identity before completing a request. Verified requests are generally processed within 30 days, subject to applicable law.
Deleting an account removes or de-identifies information that Otto is not legally required to retain. Certain financial, accounting, tax, fraud-prevention, security, dispute, and compliance records may be retained for the legally required period.
Account deletion and withdrawal of AI permission are separate actions. Withdrawing AI permission prevents future AI processing but does not automatically delete your Otto account.
We use administrative, technical, and organizational safeguards designed to protect personal information, including:
Payments are processed using providers subject to applicable payment-card security requirements. Otto does not store complete raw payment-card details.
No security system is completely secure, and we cannot guarantee that unauthorized access or disclosure will never occur.
Authorized Otto personnel may access personal information when reasonably necessary to:
Access is restricted according to job responsibilities, logged where appropriate, and subject to confidentiality and security obligations.
Human review of AI content does not ordinarily occur unless it is requested by you, necessary to investigate a problem or misuse, required for security, or required by law.
Information is primarily processed and stored in the United States.
Otto and its service providers may process information in other countries where they operate. Where required, international transfers are protected through approved contractual safeguards, such as Standard Contractual Clauses, or other legally recognized transfer mechanisms.
The Services are intended for businesses and adults and are not directed to children under 13 years of age, or a higher minimum age where required by applicable law.
We do not knowingly collect personal information from children who are not legally permitted to use the Services. If we learn that such information has been collected, we will take reasonable steps to delete it.
A parent or guardian who believes a child has provided information to Otto may contact privacy@joinotto.com.
Depending on where you live, you may have the right to:
Otto does not sell personal information or share it for cross-context behavioral advertising.
To exercise a privacy right, contact privacy@joinotto.com. We may verify your identity before completing the request.
You will not be discriminated against for exercising a privacy right.
Certain information may be subject to financial, tax, accounting, or other regulatory retention requirements.
Where applicable, Otto maintains safeguards intended to support compliance with relevant financial privacy, tax, accounting, and consumer-protection requirements.
Nothing in this Privacy Policy limits information handling required or permitted by applicable law.
If we identify a security incident involving personal information, we will investigate and take reasonable remediation measures.
Where legally required, we will notify affected users and appropriate authorities within the time required by applicable law.
If Otto ceases operations, information will be deleted, returned, transferred, or otherwise handled in accordance with applicable law and contractual obligations.
If information is transferred to a successor organization, the successor will be required to protect it consistently with this Privacy Policy. Where required, we will notify users and provide available choices regarding the transfer.
Unless retention is legally required, information will be deleted or de-identified within a reasonable period following closure.
We may update this Privacy Policy to reflect changes to our Services, providers, legal obligations, or information-handling practices.
When changes are material, we will provide notice through the Services, by email, or through another appropriate method. Where required, we will request permission before applying a materially different use of personal information.
The "Last updated" date at the top shows when this Privacy Policy was most recently revised.
For privacy questions, requests, or complaints, contact:
Otto AI Privacy Team
Email: privacy@joinotto.com
Website: https://joinotto.com
You may also use the support options available within the Otto application.