On this page
01Who we are
Othor AI is a service of Othor AI Private Limited, a company registered in India. This policy explains how we handle personal data under the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the Information Technology Act, 2000.
- Company
- Othor AI Private Limited
- Registered office
- WeWork Prestige Atlanta, No 10/12, 80 Feet Main Road, Koramangala 1A Block, Bangalore, Karnataka 560034, India
- CIN
- U62013KA2024PTC194415
- GSTIN
- 29AAECO5305K1Z9
02Two roles
- Your account. For the details of the people who sign up, sign in and receive briefs, we decide why and how the data is used: we are the Data Fiduciary.
- Your company’s data. For what Othor AI reads from the systems you connect, your company decides: it is the Data Fiduciary and we process that data on its behalf, only to provide the service it asked for.
03What we collect
- Account details: your name, work email address and role, and your company’s name, address on Othor AI, website, financial year, currency and time zone.
- Recipients: the names and email addresses of the people you add to receive briefs.
- What you tell us: your description of the business, the files you upload during setup (stored encrypted), and the definitions you confirm.
- Connection details: the address of each source and its read-only credentials, encrypted at rest and never shown back. For Google Sheets, the Google account’s email address and the access you grant to the files you pick.
- What Othor AI computes: the shape of your data (table and column names and types) and the results it computes from it: metrics, findings, forecasts and briefs. We keep computed results, not copies of your tables.
- A record of activity: who did what and when inside Othor AI, sign-in events, and technical logs with request identifiers. Logs never hold values from your systems.
- Requests for access: the name, work email and company you send through the Request access form, how many people work there, what you run today, and anything else you add.
04What we never collect
- Personal columns in your systems. Columns that hold personal data are found when a source is scanned and excluded: they are never queried, sampled or sent anywhere.
- Raw rows for an AI model. An AI model sees table and column names, types, your business description and computed summaries, never rows from your systems.
- Tracking. No analytics, advertising or tracking scripts on the site or in the app.
05Why we use it
- To provide the service you signed up for: read your sources, compute and test your numbers every night, and send the Morning Brief to the people you choose.
- To sign you in, keep your account secure, and prevent misuse.
- To answer your requests, including requests for access and support.
- To send service emails: sign-in codes, briefs, and notices about your account or this policy. We don’t send marketing email without your consent.
- To meet our legal obligations, including tax and accounting records for invoices.
We process account data with your consent, given when you sign up, and for the uses the DPDP Act allows. You can withdraw consent at any time by writing to us; we then stop the processing that relied on it and close the account as described below.
06AI
When AI drafting is on, Othor AI uses an AI model to draft setup suggestions and the wording of briefs. It never computes a number: every figure comes from a query, and a number in a model’s text that isn’t in the computed results is discarded. Nothing the model drafts goes live until you apply it. The nightly run and every number in the brief work without any model.
07Where it’s kept
Your data is stored in India, on Amazon Web Services in Mumbai (ap-south-1), encrypted at rest and in transit. Some of the services that process data for us are outside India; each is listed below with what it receives.
08Who processes it for us
These sub-processors process data on our behalf, under contracts that limit them to doing so. The same list is on the sub-processors page. We tell customers before a new sub-processor starts processing their data.
| Service | What for | Data it receives | Where |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting: the app and worker (EC2), the metadata database (RDS), files and backups (EBS, S3), DNS (Route 53), certificates, logs (CloudWatch), secrets (SSM) | Everything Othor AI stores: account and company details, the Ontology, computed results, encrypted uploads, encrypted source credentials, event history, logs (no row values) | India, ap-south-1 (Mumbai) |
| Postmark (ActiveCampaign) | Sending email: briefs, sign-in codes, alerts | Recipients' names and email addresses; email content (the brief's computed numbers and words, sign-in codes); delivery and bounce events | United States |
| Anthropic (Claude API) | AI drafting during setup and brief wording, when the model is on. The nightly run never needs it. | Table and column names and types; the business message; text from uploaded documents; images and scanned PDFs the owner uploads; computed summaries. Never raw rows from a source, never personal columns. | United States |
| Google (Sheets API, OAuth) | Reading the spreadsheets the owner picks, with read-only access the owner grants | The picked sheets' contents, read through the owner's own Google authorisation; the Google account's email address | Google's global infrastructure |
We don’t sell personal data, and we don’t share it with anyone else except where the law requires it.
09How long we keep it
- While your account is open, we keep what’s needed to provide the service.
- When an account is closed, its data is deleted 30 days later. Backups roll off within a further 35 days.
- Requests for access are kept for 12 months, then deleted.
- Invoices and the records the law requires us to keep are kept for the period the law sets.
10Your rights
Under the DPDP Act you can ask us:
- for a summary of the personal data we hold about you and how we use it;
- to correct, complete or update it;
- to erase it, where we no longer need it for the purpose you gave it for or the law doesn’t require us to keep it;
- to nominate another person to use these rights for you if you die or can’t act yourself;
- to withdraw consent you gave.
Write to privacy@othor.ai from the address on your account. If your request is about data in your company’s systems, we’ll pass it to your company, which decides, and help it respond.
11Grievance officer
If you have a concern about how we handle personal data, write to our grievance officer, Unni Krishnan Koroth, at uk@othor.ai. We acknowledge every grievance and answer it within the time the law sets. If you’re not satisfied with our answer, you can complain to the Data Protection Board of India.
12Cookies
Othor AI uses cookies only to sign you in, carry you through sign-up and setup, and keep forms secure: a session cookie, short-lived cookies that hold your place while you sign in or sign up, a form-security cookie, a cookie that shows your first run’s progress, and one that remembers the company addresses you used on this device. There are no tracking or advertising cookies.
13Security
Read-only credentials, encryption, tenant separation and the rest are described on the security page. If we learn of a breach of personal data, we tell the people affected and the Data Protection Board as the law requires.
14Children
Othor AI is a service for businesses and isn’t meant for anyone under 18.
15Changes to this policy
When we change this policy in a way that matters, we email account owners before the change takes effect. The date at the top shows the last change.
16Contact
Privacy requests: privacy@othor.ai. Anything else: support@othor.ai.