Privacy Policy

This Privacy Policy applies to personal information that we collect through our website at ontu.ai, our marketing communications, and the Ontu software platform and related services (together, the “Services”).

Our role depends on the data involved. For information about visitors to our website, prospective customers, and the individuals who hold user accounts, Ontu is the “controller” (or “business”) and determines the purposes of processing. For Customer Data (defined below), which our customers upload or connect to the Services, Ontu acts as a “processor” (or “service provider”) and processes that data only on the customer’s documented instructions and in accordance with our agreement with the customer, including any data processing addendum (“DPA”). If you are an individual whose information appears in Customer Data, please direct requests to the customer (your firm or its client) that controls that data.

If there is a conflict between this Privacy Policy and a signed agreement with a customer, the signed agreement controls with respect to Customer Data.

Information you provide to us:

• Account and profile information, such as your name, work email address, firm name, role, and authentication credentials (passwords are stored only in hashed form).
• Customer Data: documents, files, emails, calendar and meeting information, audio recordings and transcripts, tasks, notes, and other content that you or your organization upload, connect, or create within the Services.
• Communications, such as messages you send to us, demo or contact requests, and support inquiries.
• Billing and contract information necessary to administer your subscription.

Information from connected services: if you choose to connect a third-party account (for example, a Microsoft Outlook or Google Gmail mailbox), we receive the data you authorize through that provider’s permissions, such as email messages and metadata. We store access tokens for connected accounts in encrypted form and use them solely to provide the connected functionality. You may disconnect an account at any time.

Information collected automatically: log and device data such as IP address, browser type, operating system, pages viewed, referring URLs, timestamps, and diagnostic and error information; and information collected through cookies and similar technologies as described in Section 8.

We use personal information to:

• provide, operate, maintain, and secure the Services, including processing Customer Data to deliver features such as search, summarization, drafting, transcription, and task assistance at the customer’s direction;
• authenticate users, manage accounts, send transactional messages (such as invitations, login codes, and password resets), and provide customer support;
• monitor usage, enforce fair-use and plan limits, and calculate billing;
• improve, test, and develop the Services, using aggregated or de-identified information and service telemetry that does not include the substance of Customer Data;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms;
• communicate with you about the Services, respond to inquiries, and send marketing communications where permitted by law (you may opt out at any time); and
• comply with legal obligations and enforce our rights.

The Services use large language models and related AI technologies. To generate a response, Ontu sends relevant portions of Customer Data (such as retrieved document passages, emails, or transcripts, and your instructions) to third-party AI model providers acting as our sub-processors.

Ontu does not use Customer Data to train or fine-tune any generative AI model, and we contractually require our AI sub-processors not to use Customer Data submitted through the Services to train their models. Customer Data is processed only to provide the Services to the customer that submitted it and is logically separated by firm and project.

AI output may be inaccurate or incomplete. Output is intended to assist, not replace, professional judgment, and should be reviewed by a qualified person before it is relied upon or sent to others.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only as follows:

• Sub-processors and service providers that help us deliver the Services under written confidentiality and data protection obligations. Categories include cloud hosting and database infrastructure (Railway), object storage (Cloudflare), AI model providers (Anthropic and OpenAI), audio transcription (AssemblyAI and OpenAI), transactional email delivery (Resend), and error monitoring (Sentry). A current list is maintained on our Trust Center and is available on request.
• Within your organization: Customer Data and user information are visible to other authorized users of your firm and project according to the access controls configured in the Services.
• At your direction, such as when you connect a third-party integration or send a message from the Services.
• Legal and safety reasons: where we believe disclosure is required by law, regulation, subpoena, or other legal process, or is necessary to protect the rights, property, or safety of Ontu, our customers, or others. Where legally permitted and practicable, we will notify the affected customer before disclosing Customer Data.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to continued protection of personal information consistent with this Policy.
• Aggregated or de-identified information that cannot reasonably be used to identify an individual or customer.

We retain Customer Data for the duration of the customer’s subscription and as needed to provide the Services. Customers may delete content within the Services. When an account is paused or terminated, we retain Customer Data for a limited period (currently ninety (90) days unless otherwise agreed) to permit reactivation or export, after which it is deleted from our active systems, and from backups in accordance with our ordinary backup rotation.

We retain other personal information for as long as necessary for the purposes described in this Policy, to comply with legal, accounting, and regulatory obligations, to resolve disputes, and to enforce our agreements.

We maintain administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit and at rest, application-layer encryption of third-party access tokens, role-based access controls, tenant-level data separation, and monitoring of our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Additional detail is available on our Trust Center. If we become aware of a breach of security affecting personal information, we will notify affected customers and, where required, regulators, in accordance with applicable law and our agreements.

We use cookies and similar technologies that are necessary to operate the Services, such as to keep you signed in and protect against fraud. We may also use limited analytics technologies to understand how our website is used. You can control cookies through your browser settings; disabling certain cookies may affect the functionality of the Services. Our Services do not respond to “Do Not Track” signals, but we honor Global Privacy Control signals where required by applicable law.

Depending on where you live, you may have rights regarding your personal information, which may include the right to access or obtain a copy of it, correct inaccurate information, delete it, restrict or object to certain processing, receive it in a portable format, withdraw consent where processing is based on consent, and not be discriminated against for exercising your rights. Residents of California and certain other U.S. states may also have the right to know the categories of personal information collected and disclosed, and to opt out of the sale or sharing of personal information (which we do not do). Individuals in the European Economic Area, United Kingdom, and Switzerland may also lodge a complaint with their local data protection authority.

To exercise a right, contact us using the details in Section 13. We may need to verify your identity before responding. If your information is contained in Customer Data controlled by one of our customers, we will refer your request to that customer. You may opt out of marketing emails at any time using the unsubscribe link in the message.

Ontu is based in the United States, and personal information is processed and stored in the United States and other countries where we or our sub-processors operate. Where we transfer personal information from the European Economic Area, United Kingdom, or Switzerland to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, as incorporated into our DPA.

The Services are intended for business use by adults and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy with a revised “Last updated” date and, where required, by additional notice such as email. Your continued use of the Services after the effective date of an update constitutes acceptance of the updated policy to the extent permitted by law.

Ontu Software LLC, a Delaware limited liability company, is responsible for the processing described in this Policy. For questions, requests, or complaints about this Privacy Policy or our data practices, contact us at [email protected], with the subject line “Privacy Request.” We will respond within the time required by applicable law.