Privacy Policy

The short version

We collect the minimum needed to run your account and the widget. We do not sell your personal information. You can access, export, or delete your data at any time by emailing [email protected].

1. Who we are (Data Controller)

otowoto provides an embeddable video-reply widget and a dashboard to manage it. For your own account and website data, otowoto acts as the data controller. For the visitor data your widget collects on your website, you are the controller and otowoto is your processor (see section 8).

For any question or request about your data, contact us at [email protected].

2. Scope

This policy applies to visitors of otowoto.com, to customers who create an account, and to end-visitors who interact with a otowoto widget on a customer’s website.

Depending on where you live, you have rights under the GDPR (EU/UK), the CCPA/CPRA (California), and the KVKK (Türkiye). Where these laws differ, we apply the protection most favourable to you.

3. Data we collect

• Account data: your name, email address, password (stored hashed), plan, and website URL you provide at sign-up.
• Billing data: handled by our payment processor. We store only a plan status and non-sensitive references — never your full card number.
• Widget & usage data: aggregated event counts (impressions, opens, plays, clicks) used to show you statistics. These are stored in privacy-preserving analytics and are not used to profile individuals.
• Lead data: when a visitor submits a callback request through your widget, we store the phone number, country, and consent flags on your behalf, so you can follow up.
• Technical data: IP address and basic device/browser information, generally processed transiently to deliver and secure the service. For callback calls specifically, we keep more — see section 14.
• Cookies & local storage: a small amount of local storage to remember widget state and, on otowoto.com, affiliate attribution (see section 5).

4. Why we use your data and our legal bases

• To provide the service and your account — legal basis: performance of a contract.
• To process payments and prevent fraud — legal basis: contract and legal obligation.
• To keep the service secure, reliable, and to improve it — legal basis: our legitimate interests.
• To send you service and (with your consent) marketing emails — legal basis: consent and legitimate interest; you can opt out at any time.
• To comply with legal obligations such as tax and accounting — legal basis: legal obligation.

5. Cookies & tracking

otowoto does not use advertising cookies and does not track you across other websites. On otowoto.com we use essential local storage only, plus an affiliate reference parameter if you arrived through a partner link. The widget itself uses local storage on your site to remember its open/closed state and which questions a visitor already saw.

6. Sharing and sub-processors

We never sell your personal data. We share it only with the service providers strictly needed to run otowoto, each bound by a data-processing agreement.

Every one of them is named at otowoto.com/subprocessors, with its role, its location and what it does for us. That page is the single list — we keep it separate so that adding or replacing a provider never means quietly editing this policy. It also sets out the 30 days’ notice you get before the list changes and your right to object.

We may also disclose data where required by law, to protect our rights, or as part of a business transfer, in which case you will be notified.

7. International transfers

Our providers may process data outside your country, including outside the EEA, the UK, or Türkiye. Where they do, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) or an adequacy decision.

8. Data of your end-visitors

For the visitor data your widget collects (for example callback leads), you are the data controller and otowoto is your processor. You are responsible for having a lawful basis and a privacy notice for your own visitors. We process that data only on your instructions, keep it secure, and delete or return it when you close your account or ask us to.

9. Data retention

We keep account data for as long as your account is active and for a short period afterwards to meet legal and accounting obligations. Aggregated statistics are retained to show historical trends. Lead data is kept until you delete it or close your account. You can request deletion at any time.

Security logs — which account signed in, which settings changed, and the IP address they came from — are kept for one year and then deleted automatically.

10. Your rights

Under the GDPR and KVKK you can request access, rectification, erasure, restriction, portability, and object to certain processing, and withdraw consent at any time.

Under the CCPA/CPRA you can know what we collect, request deletion, correct inaccurate data, and opt out of “sale” or “sharing” — note that we do not sell or share your personal information.

To exercise any right, email [email protected]. We respond within the timeframes set by the applicable law (generally 30 days). You also have the right to lodge a complaint with your data-protection authority (in Türkiye, the KVKK Authority “KVKK Kurumu”).

11. Security

We protect your data with encryption in transit, hashed passwords, access controls, and reputable infrastructure providers. No system is perfectly secure, but we work continuously to keep your data safe and will notify you and the relevant authority of a qualifying breach as required by law.

We keep a security log of account actions such as sign-ins, settings changes and site deletions, so an unauthorised or disputed change can be traced. It records the event, never the value: a change to your telephony settings is logged as “the SIP fields changed”, never the credentials themselves. Legal basis: our legitimate interest in keeping accounts secure.

12. Children

otowoto is a business tool and is not directed to children under 16. We do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the service evolves. We will post the new version here with an updated date and, for material changes, notify you by email.

14. Callback calls

If you leave your phone number in a customer’s “Call me back” panel, that number is used to place a phone call to you immediately, connecting you with the site owner.

For each call we store the phone number, the time of the call, its duration, whether it connected, the reason if it did not, and the star rating you optionally give afterwards.

We also store your IP address and a device identifier generated by your browser, so the site owner can block abusive callers. These are kept until the site owner deletes their site.

Calls are placed through a telephony provider acting on our behalf, as our processor. We do not record calls.

The site owner also receives your number by email, as with any callback request, so they can reach you if the call does not connect.

The site owner controls this data. If they delete their site, your call records are deleted with it. You can also ask them to delete your number at any time.

15. Contact

Questions, requests, or complaints: [email protected]. Support is handled in English.