Privacy policy.

Summary in plain English

The Otterlog desktop app collects nothing about you, processes everything on your computer, and transmits three things to our servers across its entire lifetime: a license key (so we know you've paid), an anonymous version check (so we know if you need an update), and a one-time model download (so the app can transcribe). The marketing website you're reading this on uses Plausible Analytics, a privacy- respecting service that doesn't use cookies or track individuals, to measure visits and ad campaign performance.

If anything below contradicts that summary, the summary wins; tell us and we'll fix the policy.

1. Who we are

Otterlog is a product of Papi Labs Ltd, a private company registered in England and Wales. For privacy enquiries, email privacy@otterlog.ai.

For UK GDPR purposes, Papi Labs Ltd is the data controller for any personal data processed via the Otterlog website (otterlog.ai) and the Otterlog desktop application.

2. The Otterlog desktop application

2.1 What the app collects from you

Nothing. The app does not contain telemetry, error reporting, usage analytics, A/B testing, or any other observation mechanism. Recordings, transcripts, and summaries are stored only on your computer, in a database file you can locate, inspect, copy, and delete at any time.

2.2 What the app sends from your computer

The Otterlog app makes exactly three network calls. Their purpose, trigger, destination, and payload are documented in full at /privacy-proof and reproducible with Little Snitch or Wireshark. In summary:

• License check, sent to api.lemonsqueezy.com. Payload: license key + app version.
• Update check, sent to updates.otterlog.ai. Payload: current app version + your OS version.
• Model download, sent to models.otterlog.ai. A standard HTTPS GET to fetch the ML model weights, on first run only.

None of these calls contain audio, transcripts, summaries, file names, or any other content from your meetings.

2.3 Lemon Squeezy (license processor)

License purchases are processed by Lemon Squeezy. Lemon Squeezy receives the information you submit to complete the purchase (name, email, billing address, payment details) and acts as a separate data controller for that transaction. Their privacy policy is at lemonsqueezy.com/privacy.

Papi Labs Ltd receives your name, email, and license key from Lemon Squeezy in order to provide support and process refunds. We do not receive your payment details.

3. The Otterlog website (otterlog.ai)

3.1 What we collect from your visit

The marketing site you're reading uses Plausible Analytics, a privacy-respecting analytics service hosted in the EU. Plausible captures aggregated, anonymous information about visits: the pages viewed, the referrer (which website or ad you came from), the country and device type, and how long the session lasted.

Plausible does not use cookies, does not collect personal data, does not send data to advertising networks, and does not track individuals across sessions. We use it to measure marketing campaigns and decide what to write next on the site.

Their data collection policy: plausible.io/data-policy.

3.2 Email signups

If you submit your email through any form on this site (founding- member notify, newsletter, etc.), we use that email to send you the notification you signed up for. We do not sell, share, or rent email addresses. You can unsubscribe at any time from any email we send; we also process deletion requests sent to privacy@otterlog.ai within 30 days.

Email is delivered via Buttondown or a similar transactional email service (chosen per launch plan), acting as a data processor on our behalf.

3.3 Cookies

This website sets no cookies. The Plausible script does not use cookies. We do not use third-party advertising or tracking cookies of any kind.

4. Your rights (UK GDPR / EU GDPR)

If you're in the UK, EU, or another GDPR-equivalent jurisdiction, you have the right to:

• Access the personal data we hold about you (in practice: your email if you signed up; your name + email if you bought a license).
• Correct inaccurate data.
• Delete your data. We process deletion requests within 30 days, and the on-device nature of the app means we don't hold any recordings or transcripts in the first place.
• Object to processing. Practically, this means unsubscribing from emails and stopping use of the app.
• Data portability. Your recordings are already portable (they're files on your computer).
• Lodge a complaint with the UK ICO (ico.org.uk) or your local data protection authority.

To exercise any of these rights, email privacy@otterlog.ai. We respond within 30 days, usually within 5 business days.

5. Data retention

Email signups: retained while you remain subscribed. Deleted within 30 days of unsubscription or a deletion request.

License records: retained for the duration of the license, plus 7 years thereafter for accounting and warranty purposes (UK statutory retention).

Plausible analytics: retained for 24 months in aggregate, anonymous form. No individual records are kept.

6. International transfers

Personal data we collect is processed in the United Kingdom and the European Economic Area. If a sub-processor is based outside the EU/UK, the transfer is governed by Standard Contractual Clauses.

7. Changes to this policy

We'll update this page when the policy changes. The effective date at the top will change too. Material changes will be announced via email to subscribers and a banner on this page for at least 30 days.

8. Contact

Privacy queries: privacy@otterlog.ai
General contact: hello@otterlog.ai
Postal address: (TBD, registered office of Papi Labs Ltd; will be added on launch)

Notice: this policy is a working draft authored in good faith and pending review by a UK-qualified solicitor before public launch. If anything in it appears inaccurate or unclear, please email privacy@otterlog.ai.