OTTO HR PRIVACY NOTICE
Last Updated: July 18, 2026
This Privacy Notice explains how Ottohr Inc. (“Otto HR,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with our websites, the Platform, and our Services. Otto HR is based in the United States and provides business-facing human resources, applicant tracking, employee-portal, workflow, automation, and AI-enabled software to business Customers.
1. Information We Collect
We collect personal information depending on how you interact with Otto HR, including when you visit our websites, create or access an account, use the Platform, request a demo, communicate with us, receive support, complete a checkout or payment process, or otherwise use our Services.
Information you provide
We may collect information that you or a Customer provide directly to us, including names, business email addresses, phone numbers, job titles, company names, account credentials, billing details, support communications, preferences, and any information submitted through forms, onboarding flows, workspace settings, integrations, or account administration tools.
Platform and Customer-controlled information
When a Customer uses the Platform, we may process information submitted by or on behalf of that Customer, including information relating to administrators, Authorized Users, employees, contractors, applicants, candidates, workforce workflows, documents, messages, requests, records, and other content uploaded to or generated within the Platform. In many cases, this information is controlled by the Customer, and Otto HR processes it in accordance with our agreement with that Customer.
Payment information
We may collect billing information necessary to process subscriptions, purchases, invoices, and payments. Payments may be processed by third-party payment processors, including Stripe. Where payment card or payment instrument details are submitted directly to a payment processor, those details are handled by the payment processor under its own terms and privacy notice.
Information collected automatically
We may automatically collect device, usage, log, and interaction information when you access our websites, Platform, or Services. This may include IP address, device identifiers, browser type, operating system, referring URLs, pages viewed, features used, session activity, timestamps, approximate location derived from IP address, and error, diagnostic, security, and performance data.
Information from third parties and public sources
We may receive information from Customers, Authorized Users, business partners, service providers, integrations, identity or security tools, analytics providers, payment processors, and other third parties where necessary to provide, secure, support, improve, or market the Platform and Services. Where a Customer uses our candidate sourcing or talent-discovery features, we may also collect information about candidates from publicly available and third-party sources, such as professional and social networking sites, public web pages, code repositories, résumé databases, and similar sources, on behalf of and at the direction of the Customer.
Sensitive information
We do not intentionally request sensitive personal information unless it is necessary for the Platform, provided by or on behalf of a Customer, or otherwise permitted by applicable law. Customer is responsible for determining whether sensitive information should be submitted to the Platform and for obtaining any required notices, consents, permissions, and lawful bases. Otto HR does not use biometric identifiers or biometric information for its own purposes; to the extent a Customer submits biometric data to the Platform, the Customer is responsible for any notices and consents required under applicable biometric privacy laws, such as the Illinois Biometric Information Privacy Act.
2. How We Use Information
We use personal information to provide, operate, maintain, secure, and improve the Platform and Services; create and administer accounts; process subscriptions and payments; provide customer support; communicate with Customers and users; and manage our business relationship with Customers.
We may use information to configure workspaces, enable integrations, process Customer instructions, generate Platform content and Outputs, support employee portal and workflow features, troubleshoot issues, monitor performance, prevent fraud and misuse, protect the security and integrity of the Platform, and enforce our agreements and policies.
We may use information to send service-related communications, including account notices, billing notices, security alerts, product updates, support messages, and administrative communications. Where permitted by law, we may also use business contact information to send marketing communications, event invitations, product information, or other commercial messages. Recipients may opt out of marketing communications as provided in those messages.
We may use information for analytics, product development, research, quality assurance, security, debugging, auditing, compliance, legal, and internal business purposes. We may also create aggregated, deidentified, or anonymized information and use it for lawful business purposes, including analytics, benchmarking, security, and service improvement. We do not use Customer Data to train or fine-tune foundation or general-purpose AI models made available to other customers or third parties.
We may use personal information as necessary to comply with applicable law, respond to lawful requests, protect rights and safety, prevent unlawful activity, resolve disputes, collect amounts owed, and establish, exercise, or defend legal claims.
3. Legal Bases for Processing
EU, UK, and similar jurisdictions
Where the GDPR, UK GDPR, or similar data protection laws apply, we process personal information based on one or more recognized legal bases. These may include performance of a contract, compliance with legal obligations, legitimate interests, consent, and the protection of rights, safety, and security.
Canada and consent-based jurisdictions
Where applicable privacy laws require consent, we process personal information with express or implied consent, unless applicable law permits processing without consent. This may include processing necessary for fraud prevention, security, legal compliance, contractual necessity, or other permitted business purposes.
Türkiye
Where Turkish data protection law applies, we process personal data in accordance with Law No. 6698 on the Protection of Personal Data and applicable secondary legislation. Depending on the context, our processing may be based on explicit consent or another lawful basis permitted under Turkish law, including where processing is necessary for the establishment or performance of a contract, compliance with a legal obligation, establishment, exercise, or protection of a right, legitimate interests, or other lawful grounds recognized under applicable Turkish data protection law.
Where personal data is transferred from Türkiye to another country, such transfer will be carried out in accordance with applicable Turkish data transfer rules. These may include adequacy decisions, appropriate safeguards, standard contractual clauses, binding corporate rules, explicit consent, or other transfer mechanisms permitted by Turkish law.
Customer-controlled data
Where we process personal information on behalf of a Customer, the Customer is responsible for determining the appropriate legal basis, notice, consent, authorization, and transfer mechanism for collecting, using, and making that information available to Otto HR. Otto HR processes such information in accordance with the Customer’s instructions, our agreement with the Customer, and any applicable Data Processing Addendum.
4. Our Role: Service Provider or Business
For personal information submitted to the Platform by or on behalf of a Customer, Otto HR generally acts as a “service provider” or “processor” under applicable U.S. state privacy laws and processes that information only on the Customer’s behalf and documented instructions. Requests to exercise privacy rights with respect to such information are generally directed to, and fulfilled by, the Customer as the “business” or “controller,” and Otto HR will assist the Customer as required by applicable law and our agreement.
Otto HR acts as a “business” or “controller” with respect to information it collects for its own purposes, such as website-visitor, prospect, marketing, account-administration, billing, and security information. This Privacy Notice describes our practices in that capacity; where we act as a service provider or processor, the Customer’s privacy notice governs.
5. How We Share Information
We may share personal information with service providers, vendors, contractors, and subprocessors that assist us in providing, operating, securing, supporting, and improving the Platform and Services. These may include hosting, cloud infrastructure, analytics, customer support, communications, security, payment processing, AI infrastructure, and other technical or business service providers.
We may share information with Customers and Authorized Users as needed to administer accounts, manage workspaces and permissions, provide employee portal and workflow features, respond to support requests, and carry out Customer instructions. Customer controls access to Customer-controlled information through its account settings, administrators, permissions, and integrations.
We may share information with third-party integrations or services when enabled or authorized by Customer or an Authorized User. We may also disclose information where required or permitted by law, legal process, regulatory request, enforcement of our agreements, fraud prevention, security protection, corporate transactions, or protection of the rights, safety, and interests of Otto HR, Customers, users, or third parties.
We may share aggregated, deidentified, or anonymized information where it does not reasonably identify an individual or Customer and where permitted by applicable law.
6. Cookies and Similar Technologies
We may use cookies, pixels, local storage, log files, software development kits, and similar technologies to operate the website, maintain sessions, remember preferences, understand usage, improve performance, support security, measure marketing activity, and enhance the Platform and Services.
Some technologies are necessary for authentication, security, fraud prevention, account functionality, and service delivery. Others may be used for analytics, product improvement, or marketing where permitted by applicable law.
You may be able to control cookies through your browser settings or, where available, through our cookie preferences tool. Disabling certain cookies may limit the availability or functionality of the website, Platform, or Services.
We may allow analytics, advertising, or other third-party providers to use similar technologies on our website or services. Their use of such technologies may be subject to their own privacy notices and choices.
7. Data Retention and Security
Retention
We retain personal information only for as long as reasonably necessary to provide the Platform and Services, fulfill the purposes described in this Privacy Notice, comply with legal, accounting, tax, security, and contractual obligations, resolve disputes, enforce our agreements, and support legitimate business needs. In determining retention periods, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and applicable legal requirements.
When personal information is no longer needed, we will delete or anonymize it. If deletion is not immediately possible, including because the information is stored in backup systems or archival records, we will take reasonable steps to securely isolate it until deletion is feasible.
Security
We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. However, no internet transmission, network, system, or electronic storage technology can be guaranteed to be completely secure. We cannot promise that unauthorized third parties will never be able to defeat our safeguards.
Minors
The Platform and Services are intended for business use and are not directed to individuals under 18 years of age. We do not knowingly collect personal information from, or market to, individuals under 18. If we learn that personal information from an individual under 18 has been submitted to Otto HR without appropriate authorization, we will take reasonable steps to delete or deactivate that information. If you believe such information has been submitted to Otto HR, please contact us.
8. Your Privacy Rights
Depending on where you are located and which laws apply, you may have certain rights regarding your personal information.
EEA, UK, Canada, and similar jurisdictions
If you are located in the EEA, the UK, Canada, or another jurisdiction with similar privacy rights, you may have the right to request access to, correction of, deletion of, restriction of, or portability of your personal information. You may also have the right to object to certain processing, withdraw consent where processing is based on consent, or lodge a complaint with a competent data protection authority.
Türkiye
If Turkish data protection law applies, you may have rights under Law No. 6698 on the Protection of Personal Data. These may include the right to learn whether your personal data is processed, request information about processing, learn the purpose of processing and whether the data is used in accordance with that purpose, know the third parties to whom personal data is transferred, request correction of incomplete or inaccurate data, request deletion or destruction where permitted by law, object to results produced exclusively through automated processing, and request compensation for damages arising from unlawful processing.
Withdrawing consent
Where we rely on consent to process personal information, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal or processing conducted on another lawful basis.
Account information
You may review, update, or request deletion of certain account information by contacting us or, where available, through your account settings. We may retain limited information where necessary to comply with law, prevent fraud or misuse, maintain security, resolve disputes, enforce our agreements, or protect legal rights.
Customer-controlled information
If your personal information is processed on behalf of a Customer, including through a Customer workspace, employee portal, applicant workflow, or other Customer-controlled feature, we may refer your request to that Customer or respond in accordance with the Customer’s instructions and our agreement with that Customer.
9. U.S. State Privacy Rights
California
If you are a California resident, California privacy laws may provide you with specific rights regarding your personal information. These rights may include the right to know what personal information we collect, use, disclose, sell, or share; the right to access and receive a copy of personal information; the right to request deletion; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit certain uses and disclosures of sensitive personal information where applicable; and the right not to receive discriminatory treatment for exercising privacy rights. California’s “Shine the Light” law may also permit California residents to request information about certain disclosures of personal information to third parties for their direct marketing purposes.
Sale and sharing of personal information
We do not sell personal information for monetary consideration. Some uses of cookies, analytics, or advertising technologies may be considered a “sale” or “sharing” (cross-context behavioral advertising) under California and other state privacy laws. Where they are, we provide a “Do Not Sell or Share My Personal Information” link and honor opt-out requests as described below.
Sensitive personal information
Where we collect sensitive personal information, we use and disclose it only for purposes permitted under applicable law, such as providing the Services, security, fraud prevention, and legal compliance, and not to infer characteristics about you. Because we limit our use of sensitive personal information to such permitted purposes, the right to limit the use of sensitive personal information may not apply; where it does apply, we will honor valid requests.
Automated decisionmaking technology and profiling
Applicable state privacy laws, including California’s regulations on automated decisionmaking technology (ADMT), provide rights in connection with certain automated processing and profiling used to make decisions that produce legal or similarly significant effects, including in employment. Where Otto HR uses ADMT to make a significant decision about you in its capacity as a business or controller, you may have the right to receive advance notice, to access information about the logic involved and how outputs are used, and, subject to applicable exceptions, to opt out of or appeal such processing. Where ADMT or profiling is used in connection with a Customer’s employment or workforce decisions, the Customer is the business or controller and such requests are directed to the Customer, and Otto HR assists the Customer as required by law and our agreement. These requirements are being phased in under applicable law.
Opt-out preference signals
Where required by California, Colorado, Connecticut, Texas, and other applicable state privacy laws, we honor recognized universal opt-out mechanisms, such as the Global Privacy Control (GPC), as a valid request to opt out of the sale or sharing of personal information and, where applicable, targeted advertising.
Other U.S. states
Residents of other U.S. states with comprehensive privacy laws may have similar rights, including the right to confirm processing; access, correct, delete, and obtain a portable copy of personal data; opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; appeal a denial; and non-discrimination, subject to applicable limitations and exceptions. Several state laws require opt-in consent to process sensitive data; where such information is Customer-controlled, the Customer is responsible for obtaining any required consent.
Requests and verification
To exercise applicable U.S. state privacy rights, you may contact us using the contact information in this Privacy Notice or use any privacy request mechanism we make available. We may verify your identity and, where applicable, the authority of an authorized agent before responding to a request. If we deny your request, you may have the right to appeal our decision where required by applicable law, and we will provide instructions for submitting an appeal in our response where applicable.
Minors
We do not knowingly sell or share the personal information of individuals under 18 years of age.
10. Supplemental Disclosures for Platform, HR, and AI Features
The following disclosures provide additional detail about how Otto HR may process personal information in connection with the Platform, including human resources, applicant tracking, employee portal, workflow, automation, and AI-enabled features. These disclosures supplement the sections above and do not limit any other provision of this Privacy Notice.
Additional Platform data categories
In addition to the information described in Section 1, Otto HR may process the following categories of information through the Platform:
• Account and administrator information: names, business email addresses, phone numbers, job titles, company details, workspace roles, permissions, account settings, login records, and authentication information;
• Applicant and candidate information: names, contact details, résumés, employment history, education history, skills, qualifications, interview notes, application status, assessments, communications, and related applicant or candidate records;
• Employee and contractor information: names, contact details, job titles, departments, employment status, start dates, role information, manager information, employee records, onboarding information, requests, approvals, documents, and related workforce information;
• Document and workflow information: files, forms, approvals, acknowledgments, messages, notes, tasks, workflow history, employee portal submissions, internal requests, and records generated or uploaded through the Platform;
• Usage, device, and security information: IP addresses, device identifiers, browser type, operating system, log data, session activity, pages or features used, timestamps, diagnostic data, error reports, and security event information;
• Communications and support information: emails, chat messages, support tickets, call notes, meeting notes, feedback, survey responses, and other communications with Otto HR; and
• AI input and output information: prompts, instructions, uploaded content, extracted information, summaries, classifications, recommendations, matches, rankings, drafts, and other content generated by or through AI-enabled features.
Candidate sourcing and public sources
Where enabled by a Customer, the Platform’s candidate sourcing and talent-discovery features may identify and compile information about potential candidates from publicly available and third-party sources on behalf of, and at the direction of, the Customer. Otto HR is a software provider and does not act as a “consumer reporting agency,” and the Platform and its outputs are not “consumer reports” or “investigative consumer reports,” under the Fair Credit Reporting Act or analogous laws. The Customer is the controller of, and determines the purposes and means of processing for, candidate information sourced through these features, and is responsible for providing any required notices to, establishing a lawful basis for processing the information of, and honoring the rights of, such candidates.
Customer-controlled data
Where personal information is submitted to the Platform by or on behalf of a Customer, the Customer generally controls the relevant information and determines the purposes for which it is used. Otto HR processes Customer-controlled information to provide, operate, secure, support, and improve the Platform and Services in accordance with the Customer’s instructions, our agreement with the Customer, and any applicable Data Processing Addendum.
Subprocessors
Otto HR may use subprocessors and service providers to support the Platform and Services, including cloud hosting, infrastructure, analytics, security, communications, customer support, payment processing, AI infrastructure, and other technical or business services. Subprocessors are required to process personal information only for authorized purposes and subject to confidentiality, security, and data-processing obligations.
International data transfers
Otto HR is based in the United States, and personal information may be processed in the United States and other jurisdictions where Otto HR, its affiliates, service providers, or subprocessors operate. Where required by applicable law, international transfers will be supported by appropriate transfer mechanisms, which may include standard contractual clauses, data processing agreements, adequacy decisions, transfer impact assessments, supplementary safeguards, explicit consent, or other lawful transfer mechanisms.
Risk assessments
Where our processing presents a significant risk to consumer privacy under applicable law, including certain uses of automated decisionmaking technology or sensitive personal information, we conduct and document risk assessments as required.
Security and incident response
Otto HR maintains administrative, technical, and organizational safeguards designed to protect personal information. If Otto HR becomes aware of a security incident involving personal information, Otto HR will assess the incident and provide notices to affected Customers, users, regulators, or other parties where required by applicable law, our agreements, or any applicable Data Processing Addendum.
AI features and automated tools
The Platform may include AI-enabled or automated features that assist with workflow automation, analysis, classification, summarization, matching, ranking, drafting, recommendations, and similar functions. Information submitted to these features and the outputs generated by them may be processed to provide, secure, support, and improve the Platform and Services, subject to applicable agreements and data-processing terms.
No employment decisions by Otto HR
Otto HR does not make hiring, employment, compensation, benefits, disciplinary, termination, or other workforce decisions on behalf of Customers. Customers are responsible for reviewing AI-generated or Platform-generated outputs and for making all decisions relating to their applicants, candidates, employees, contractors, and workforce.
11. Contact and Updates
Contact
If you have questions about this Privacy Notice or Otto HR’s privacy practices, or if you wish to submit a privacy request, you may contact us at:
privacy@ottohr.com support@ottohr.com
If your request relates to personal information controlled by a Customer, we may refer your request to that Customer or respond in accordance with the Customer’s instructions, our agreement with that Customer, and applicable law. If you are located in the EEA or the UK and applicable law requires us to designate a representative, you may contact our representative at legal@ottohr.com.
Updates to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our Services, privacy practices, legal requirements, or business operations. When we make changes, we will update the “Last Updated” date above and may provide additional notice where required by applicable law. Your continued use of the website, Platform, or Services after an updated Privacy Notice becomes effective indicates that you have reviewed the updated notice, to the extent permitted by applicable law.