Privacy Policy

1. Who we are and how to contact us

Otto ("Otto", "we", "us") provides language learning applications and related services (the "Service"). We are the controller of your personal information unless stated otherwise. You can contact us at privacy@otto-app.com or by mail: Otto, Unit 9 Wilderbrook Way, Mullacott Ind Estate, EX34 8FN, United Kingdom.

2. Scope

This Policy explains how we collect, use, disclose, and protect personal information when you use our websites, mobile applications, and related services. Some features may launch to limited users or regions.

3. Information we collect

3.1 Information you provide

• Account data: age, email address, password or single sign-on identifier, and optional profile fields (for example display name or gender).
• Learning data: course selections, lesson history, scores, streaks, goals, placement tests, and feedback.
• User-generated content and communications: posts, comments, text or audio you submit for learning or community features, and messages you send to support.
• Payment and subscription data: if you make a purchase, we receive transaction metadata from our payment processor. We do not store full card numbers.
• Preferences: app language, notification choices, accessibility settings.

3.2 Information collected automatically

• Device and usage data: app version, operating system, device identifiers, IP address, time zone, crash logs, diagnostics, and interaction events.
• Approximate location: derived from IP address or, if you grant permission, device location to localize content and features. You can disable device location in your operating system settings.

3.3 Information from third parties

• Single sign-on and app stores: basic profile and purchase status from Apple, Google, or similar services you use to sign in or purchase.
• Analytics, attribution, and crash reporting partners.
• Moderation vendors that help us detect and handle content that violates our guidelines.

3.4 Sensitive information

We do not require sensitive information. If you use speaking or audio features, we process your voice input to provide the feature. Do not submit information you do not want processed.

4. Cookies and similar technologies

We and our service providers use cookies and software development kits to operate the Service, measure performance, remember preferences, personalize learning content, and, where permitted, support advertising, campaign measurement, and affiliate link attribution.

• Controls: you can disable cookies or reset advertising identifiers in your browser or device settings.
• EU and UK: we only use non-essential analytics, advertising, or affiliate technologies after you provide opt-in consent collected via an in-app prompt. You can change your choices at any time using the link in Settings or by contacting privacy@otto-app.com.

5. Why we process personal information and our legal bases

We process personal information for the purposes listed below. For users in the EU and UK, the legal bases are indicated in parentheses.

• Provide and operate the Service, create and manage accounts, deliver lessons, track progress, process purchases, and provide customer support (contract; legitimate interests for diagnostics; legal obligation for receipts).
• Personalize and improve the Service, adapt difficulty, recommend lessons, run product research and A/B tests, and fix bugs (legitimate interests; consent where required for non-essential cookies or similar technologies).
• Safety, security, and integrity, including detecting and preventing fraud, abuse, spam, and enforcing our guidelines, which may include automated and human review of content (legitimate interests; legal obligation where applicable).
• Communicate with you about transactions, service updates, and changes; send optional surveys; send marketing messages where permitted (contract or legitimate interests for transactional messages; consent where required for marketing).
• Analytics and measurement to understand usage and performance (legitimate interests; consent where required).

f. Advertising and campaign measurement. Personalized advertising is opt-in only and is not used without your consent. We may show contextual or non-personalized adverts without using your personal profile (consent in EU and UK where required by local law; legitimate interests or consent in other regions as required).

g. Affiliate links and attribution. We may include links to third-party merchants or services. Where affiliate tracking is available, we will only use cookies or identifiers for attribution after you provide opt-in consent. Without consent, affiliate links will operate in a non-tracking form such as promo codes or aggregate, non-identifying reports (consent in EU and UK where required; legitimate interests or consent elsewhere as applicable).

h. Compliance with laws, responding to lawful requests, tax and accounting, and exercising or defending legal claims (legal obligation; legitimate interests).

6. Advertising, affiliate links, and your choices

6.1 Default mode (no personalized ads or tracking)

By default, we do not use your personal profile information to display targeted ads or to perform affiliate or cross-app tracking. Without your consent, we will not build or use advertising or affiliate profiles and we will request contextual or non-personalized adverts. In the EU and UK, we only use non-essential advertising or affiliate technologies with your prior consent.

6.2 Opt-in personalized advertising

You may choose to enable personalized advertising in the app. When you opt in, we may create a profile using information such as your app interactions, approximate location, device and app identifiers, and declared interests to help select more relevant adverts.

• Consent and withdrawal: personalized advertising is used only after you provide opt-in consent through an in-app prompt. You can withdraw consent at any time in Settings or by contacting privacy@otto-app.com. After withdrawal, we stop using your information for personalized advertising and show non-personalized adverts.
• Third parties: when personalized advertising is enabled, we may share limited identifiers and advertising events with advertising and measurement partners to deliver and measure adverts. In California and certain other U.S. states, this may be considered "sharing" for cross-context behavioral advertising; you can opt out at any time using the "Do Not Sell or Share My Personal Information" option or by contacting us.
• Sensitive categories and minors: we do not include sensitive categories (for example health, ethnicity, religious beliefs) in advertising profiles and we do not use personalized advertising for users we know are under the applicable age thresholds where profiling is restricted.

6.3 Affiliate links and attribution

We may include affiliate links to third-party merchants or services. If you enable affiliate tracking consent, we and our partners may use identifiers or cookies to measure when a link from the app leads to a visit or purchase in another app or website. If you do not enable this tracking, we will use non-identifying methods only, such as promo codes, manual referral entries, or aggregate reports that do not link purchases to individual users.

6.4 Apple App Tracking Transparency (iOS)

If you allow Apple's App Tracking Transparency prompt, we and our partners may link your app activity with data from other apps and websites for advertising or affiliate attribution. If you select "Ask App Not to Track," we will not use identifiers for cross-app tracking and ads and affiliate links will use only non-personalized or non-identifying methods. This iOS choice is separate from EU/UK consent, which we request where required.

6.5 Android and Google Play

On Android, we honor your regional choices. In the EU and UK we request consent before using non-essential analytics, advertising, or affiliate technologies. If you decline, we provide essential features and non-personalized ads and affiliate links operate without identifiers.

7. Automated decision-making and profiling

We use profiling to tailor lesson difficulty and recommendations, and, if you opt in, for advertising. These processes do not produce legal or similarly significant effects. You can object to or opt out of profiling for marketing and advertising, and you may disable personalized recommendations where offered in Settings where applicable law provides such rights.

8. How we share personal information

We share personal information with the following categories of recipients:

• Service providers acting on our instructions, such as cloud hosting, analytics, crash reporting, customer support, email and push delivery, content moderation, and payment processing.
• Advertising and measurement partners for campaign delivery and measurement when you have opted in to personalized advertising, or for non-personalized adverts as necessary to serve and secure adverts.
• Affiliate and attribution partners if you have opted in to affiliate tracking; if you have not opted in, we use non-identifying or aggregate reporting methods.
• Legal, compliance, and safety recipients, such as authorities, auditors, and professional advisors when required by law or necessary to protect rights, users, or the Service.
• Business transfers in connection with a merger, acquisition, or reorganization, subject to appropriate safeguards and notice where required.

We do not sell personal information for money. We do not allow vendors to use your personal information to train their general-purpose models unless you explicitly opt in. For AI-powered features, we may send necessary snippets of your inputs and outputs to vendors under contractual limits; human review may occur to maintain quality and safety.

9. International data transfers

We process data in the United Kingdom and may transfer personal information to the European Economic Area, the United States, and other countries. Where required, we use appropriate safeguards, such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and vendor assessments. If an adequacy decision applies, we may rely on it. You can request more information about these safeguards by contacting privacy@otto-app.com.

10. Retention

We keep personal information only as long as needed for the purposes described in this Policy or as required by law.

• Account and learning data: retained while your account is active and deleted or anonymized within 90 days after you confirm account deletion, subject to legal holds or dispute resolution.
• Transaction records: retained for 6 years for tax and accounting.
• Logs and diagnostics: retained for 12 to 24 months unless needed longer for security, fraud prevention, or incident investigation.
• Marketing preferences and consent records: retained as required by law and to demonstrate compliance.
• Affiliate attribution events: retained for up to 13 months unless required longer to investigate fraud or verify commission claims.

Aggregated or de-identified information may be retained indefinitely.

11. Your choices

• Settings: manage privacy, analytics, advertising, affiliate tracking, cookie, and communication preferences in the app Settings where available.
• Device and browser: control cookies, reset or limit advertising identifiers, and control permissions such as microphone, camera, and location in your operating system or browser.
• Contact: you can always email privacy@otto-app.com to change your advertising or affiliate choices, withdraw consent, or request non-personalized adverts and links.

12. Your rights

Your rights depend on your location and may include the right to access, correct, delete, restrict, or object to certain processing, data portability, withdraw consent, and opt out of targeted advertising, sale or sharing, or profiling for decisions that produce legal or similarly significant effects.

• How to exercise: use in-app Settings where available or email privacy@otto-app.com with your request and region of residence.
• Verification: we may request information to verify your identity and residency.
• Appeals (for certain U.S. states such as Virginia and Colorado): if we decline your request, you may appeal by replying to our decision. We will respond within the required timeframe with our final decision and further options.
• EU and UK complaints: you have the right to complain to a supervisory authority. In the UK this is the Information Commissioner's Office. We encourage you to contact us first so we can address your concerns promptly.

We will not discriminate against you for exercising rights legally available to you.

13. Children's privacy

The Service is not directed to children under 13, and children under 13 may not create an account. In the EU and UK, the minimum age for consent may be higher (between 13 and 16 depending on the country). We do not knowingly collect personal information from children under the applicable age without verifiable parental consent. If you believe a child has provided personal information to us, contact privacy@otto-app.com and we will take appropriate action.

14. Security

We implement technical and organizational measures appropriate to the risk, including encryption in transit, access controls, least-privilege practices, and regular reviews. No system is completely secure. If a breach occurs that affects your personal information, we will notify you and regulators as required.

15. Third-party links and services

The Service may link to third-party websites or services, including payment processors and affiliate merchants. Their privacy policies govern their handling of your information. Review their policies before providing personal information.

16. Regional disclosures for California and other U.S. states

16.1 California notice at collection (CPRA)

• Categories collected in the last 12 months: identifiers (such as email and device identifiers), internet or usage data, approximate geolocation, commercial information (such as purchases), and inferences (such as a learning profile). We do not knowingly collect sensitive personal information as defined by CPRA other than account credentials you create; we do not use sensitive personal information for purposes other than those permitted by CPRA.
• Purposes: as described in Sections 5, 6, and 8, including providing the Service, security, analytics, personalization of learning content, advertising, and affiliate attribution as applicable.
• Sale or sharing: we do not sell personal information for money. We may "share" certain identifiers and usage data with advertising or affiliate partners for cross-context behavioral advertising or attribution only if you have opted in to personalized advertising or affiliate tracking; you can opt out or withdraw consent at any time in Settings or by contacting us. We honor legally recognized opt-out signals where applicable.
• Retention: as described in Section 10.
• Rights: access, delete, correct, portability, opt out of sale or sharing, limit use of sensitive personal information (where applicable), and non-discrimination. You can exercise these rights as described in Section 12.

16.2 Appeals

If we deny your privacy request, you may appeal by replying to our decision notice. We will respond within the required period.

17. International users

By using the Service, your information may be processed in countries that may have data protection laws different from those in your country. We apply the safeguards described in Section 9 for such transfers.

18. Changes to this Policy

We will post any changes to this Policy in the app or on our website and update the effective date. If we make material changes, we will notify you through the Service or by email. Your continued use of the Service after the effective date means you accept the updated Policy.

19. Contact

Questions or concerns about this Policy or our data practices can be sent to privacy@otto-app.com or by mail to: Otto, Unit 9 Wilderbrook Way, Mullacott Ind Estate, EX34 8FN, United Kingdom.