Privacy Policy

Last updated: 18 September 2026

This policy explains what we collect, what we do with it, where it goes, and what you can ask us to do about it. We would rather state the real position, including where a control is still on our roadmap, than imply more than we have earned.

1. Scope

This policy covers Othor Cloud, our hosted product, and our website.

If you run Cloud + your own keys, everything here applies except that analysis is processed under your own AI provider contract rather than ours. If you run self-hosted, Othor runs inside your perimeter and we do not receive your business data at all, only billing and any support correspondence reach us.

Where we process personal data on your behalf as part of the service, we act as a processor (a data processor under India's DPDP Act, 2023, and under the GDPR where it applies) and our Data Processing Agreement governs that processing. Where we process your account, billing and website data, we act as the controller.

2. What we collect

1. Source data:

The records in the data sources you connect. For SQL sources we query them in place, we run a query and keep the answer, not the tables behind it. Personal data may pass through this path if it is present in your sources.

2. Metadata about your sources:

Connection credentials (encrypted), column names, column types, summary statistics, metric definitions and the SQL behind them.

3. Analysis results:

The insights, narratives, charts and briefs we generate, including the numbers inside them. These are stored so we can show them again without re-running the analysis.

4. Document extracts:

If you enable the optional document intelligence agent for a Drive, SFTP or upload connection, we extract the tables from those files and store them. See section 5.

5. Account and billing data:

Name, email, Google account id if you sign in with Google, workspace name and role, plan type, billing name, address and transaction records. Card details are entered directly with Stripe and are never stored by Othor.

6. Usage and device data:

Pages visited, time spent, feature usage patterns, interface interactions, page URL and user agent. This is collected in-product and is linked to your email, workspace id and role, it is not anonymous at the point of collection.

7. Website submissions:

Name, email, subject, message and optional company or page URL from our contact, bug-report and feature-request forms.

3. What we retain, cache and never store

1. Retained while your account is active:

Connection credentials, encrypted
Column names, types and summary statistics
Insights, narratives and charts we generate, including the numbers inside them
Metric definitions and the SQL behind them
Workspace and dashboard configuration
Account details and usage analytics

2. Held transiently, in caches that expire on a defined TTL:

Query results materialised during an analysis
Cached responses that avoid re-running identical analyses

3. Never retained, at any point:

A replica of your warehouse or production database
Payment card details
Credentials in cleartext, anywhere

Nothing cached is used for model training. Section 9 sets out how long each category survives after you cancel.

4. How we use your data

Purpose	What it uses
Connecting to your sources securely	Encrypted connection credentials
Generating analysis	Source data, column names and definitions, metric definitions
Showing results again quickly, without reprocessing through a model	Stored analysis results and short-lived caches. This reduces latency and conserves computation.
Operating the workspace	Account details, roles, sharing settings, audit log
Improving the product	Usage data, feature adoption, performance and error patterns
Support and correspondence	Your messages and the account context needed to answer them
Billing	Billing details processed by Stripe
Security and abuse prevention	Logs, alerts and audit records

We do not use your source data, metadata or analysis results to train models. Where we refer to "service improvement", we mean diagnosing issues, measuring feature usage and planning product work, not training, and not disclosure to anyone outside the subprocessors in section 7.

5. The document intelligence agent

This is an optional feature that you enable per connection. Files are not queryable the way a database, so to analyse Drive, SFTP or uploaded documents we extract their tables first. For those connections only:

"Queried in place" does not apply. Extracted tables from your files are stored in our database for the life of that connection. This is not a replica of your warehouse, and it is removed when you disconnect the source.
Extracts are not held transiently. They persist so the agent can keep answering without re-reading every file, and are deleted when the connection is deleted, and on account closure.
Personal data in files stays personal data. If a sheet or document contains personal data, its extracts and the narratives generated from it can hold that personal data too. This is one reason not to connect sources containing health information, see section 11.

Extracts are encrypted at rest, scoped to your workspace, never used for training, and never sold or shared. If you connect only SQL sources, none of this applies to you.

6. AI model providers

On Othor Cloud, OpenAI is the default provider for analysis, discovery, chat and document intelligence. Anthropic is used where a workspace assigns a Claude model, or as a platform fallback. Both process requests in the United States on the default Cloud path.

For those requests, the provider receives the prompts and data submitted for analysis, and the generated outputs.

Provider contracts prohibit training on submitted content.
Zero-retention processing is available on Enterprise plans, or when you bring your own keys.
You may assign models per task and switch at any time.
If you bring your own provider contract and keys, analysis runs under the terms you negotiated, and that provider's retention and privacy practices apply instead of ours.

We encourage you to review the privacy policy of any provider in your path, since each maintains its own retention and usage policies outside our control.

7. Subprocessors and data sharing

We do not sell your data, and we do not share it for advertising. We disclose it only to the subprocessors that operate the service, and only to the extent each one needs.

1. Subprocessors that may process customer data (Othor Cloud):

Subprocessor	Purpose	Region
Amazon Web Services	Hosting, database, cache, object storage, CDN, queues, logs and backups	eu-north-1 (Stockholm); CDN edge locations serve globally
OpenAI	Default model for analysis, chat and document intelligence	US
Anthropic	Model used when a workspace assigns a Claude model, or as fallback	US
Postmark (ActiveCampaign)	Transactional product email verification, invites, password resets, narrative and digest alerts	US, unless the server is set to their EU data centre
Amazon SES	Website contact, bug and feature-request forms	eu-north-1
Stripe	Payment and subscription billing	US / EU / IN, per the Stripe account
Mixpanel	In-product analytics	EU ingest
Mailchimp (Intuit)	Account and marketing list at signup and verification	US
Google	Sign-in with Google; optional Drive and Calendar connections	Global
Slack	Optional customer notifications to your workspace; internal alerts for website forms	US

2. Optional, path-specific:

Tavily (external news lookup, receives query text), Sugra and Terminalfeed (external market and series data, receive a symbol and date range, not your source tables). These run only when those streams are enabled.
Public statistical APIs we call without sending customer records, the World Bank, BIS, Open-Meteo and open.er-api for FX, receive a series id or currency code, not your data, and are not listed as subprocessors.

3. Internal systems:

Support and sales correspondence can reach our internal Slack and Notion. Staff are instructed in writing not to paste customer source data, credentials or analysis output into either.

4. Website only:

Our marketing site and app shell load fonts from Adobe Fonts, which may see a visitor's IP address. Adobe receives no analysis data or credentials.

5. Notice of change:

We give at least 30 days' notice before adding or replacing a subprocessor that processes customer data. Email security@othor.ai to be notified. The current list is published at othor.ai/subprocessors.
We may also disclose data where legally compelled, or to protect the rights, safety or security of Othor, our customers or the public.

8. Where your data is stored

By default, everything Othor stores lives in AWS eu-north-1 (Stockholm, Sweden). Content delivery edge locations may serve the application globally.

Analysis may be processed by your configured model provider, which can sit outside that region by default in the United States, unless you bring your own model or self-host. Several subprocessors in section 7 also process limited data outside the EU.

Enterprise customers can request a different storage region where residency requires it. Talk to your point of contact.

9. Data retention

Data	While active	After cancellation
Connection credentials	Retained, encrypted	Removed when the account terminates
Column names, types and summary statistics	Retained	90 days, then permanently deleted
Analysis results and metric definitions	Retained for your reference	90 days for reactivation, then permanently deleted
Workspace and dashboard configuration	Retained	90 days, then permanently deleted
Document extracts	For the life of the connection	The data is deleted when you disconnect the source and when you close your account. It is not retained for the 90-day period.
Query result caches	Expire on a defined TTL	Not retained
Account and billing records	Retained	Kept for the period tax, accounting and company law require
Usage data	Retained	Only as long as needed for service improvement, with periodic review and removal
Support correspondence	Retained	Until no longer needed for the matter and our records

You can export your analysis results and configuration in standard formats at any time while your account is active, and during the 90-day window after cancellation. We will confirm the retention behaviour of any specific connector in writing on request.

10. Security

1. In place today:

TLS 1.2 or higher on our APIs and load balancers; AES-256 encryption for data at rest in AWS.
Connection credentials encrypted separately and never displayed back in cleartext.
Organisation admin and member roles, per-agent sharing, and Google sign-in. Each request is bound to the workspace in the session; another workspace's briefs, jobs and sources are not readable by id, and database policies enforce the same boundary.
Staff access is least-privilege, logged, and revoked when someone leaves.
Centralised logging with alerting on anomalous activity, and a documented incident response plan with named owners.
Peer-reviewed changes, automated dependency and vulnerability scanning, separated environments, encrypted backups with documented restore procedures, and vendor review before adoption.
A customer-facing audit log: workspace admins can see who connected a source, ran an analysis or changed sharing, and export it.

2. On our roadmap:

SAML and OIDC single sign-on are in development.
An independent penetration test is planned ahead of our SOC 2 report, with a summary available under NDA.

3. Certifications:

SOC 2 Type II : our control environment is implemented and operating, and we are inside the observation window. The independent audit is targeted for Q4 2026. Until then we share control documentation and complete security questionnaires directly.
DPDP Act, 2023 : we operate to the Act today. Formal certification schemes do not yet exist under it; when they do, we will pursue them.
DPA : available on request, covering processing scope, subprocessors, security measures and breach notification.
HIPAA : not supported. We do not sign BAAs.

No system is perfectly secure, and we cannot guarantee absolute security. Report a suspected vulnerability to security@othor.ai and we will acknowledge it within one business day.

11. Data you should not send us

Please do not connect sources containing Protected Health Information. We do not sign Business Associate Agreements and do not support HIPAA workloads. Take particular care before enabling the document intelligence agent on sources that contain personal data, given section 5. If you have a use case that needs HIPAA support, tell us and we will consider certification around a real need.

12. Breach notification

If a personal data breach affects you, we notify you without undue delay, and report to the Data Protection Board of India within the timelines the DPDP Act requires. Where the GDPR applies, we support our customers in meeting their own notification obligations.

13. Your rights

Depending on where you are and your relationship with us, you may:

Access and review the information we hold about you;
Request correction of inaccurate or incomplete data;
Request erasure, subject to legal and contractual retention requirements;
Export your data in standard formats;
Control usage-data collection preferences;
Withdraw consent for processing, where processing rests on consent;
Nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act; and
Raise a grievance with us, and escalate to the Data Protection Board of India or another competent supervisory authority.

If you are an end user of a customer's workspace rather than our direct customer, we will usually refer your request to that customer, who controls the data, and support them in answering it.

To exercise a right, email uk@othor.ai. We aim to acknowledge privacy inquiries within 48 hours and to resolve them within the timelines applicable law requires.

14. Cookies and analytics

We use cookies and similar technologies that are necessary to sign you in and keep the product working, and in-product analytics through Mixpanel to understand feature usage and performance. Our marketing site and app shell load fonts from Adobe Fonts, which may see your IP address. You can manage cookies through your browser; disabling necessary cookies will prevent sign-in.

15. Children

Othor is a business product and is not directed at children. We do not knowingly collect personal data from children. If you believe a child's data has reached us, contact uk@othor.ai and we will delete it.

16. Changes to this policy

We update this policy when our practices, subprocessors, deployment models or legal obligations change. Significant updates are communicated by email or in-app notification, and subprocessor changes carry the 30 days' notice in section 7.

17. Contact and grievance redressal

Privacy queries, rights requests and grievances: uk@othor.ai
Security, DPA, subprocessor list and questionnaires: security@othor.ai
Postal: Othor AI Private Limited, Bangalore, Karnataka, India

We strive to respond to all privacy-related inquiries within 48 hours.