Privacy Policy

Ottsa (“Ottsa”, “we”, “us”) is based in Bucharest, Romania. For the personal data described in this policy, we are the controller.

You can reach us about privacy at [email protected].

This policy covers personal data about:

• people who visit ottsa.com or send us a message;
• people with an account on my.ottsa.com, where we sell licenses, provide support and run our affiliate program, and the users they give access to;
• the owners of Ottsa installs, as far as the license check tells us about them.

It does not cover the data our customers keep about their clients in their own Ottsa installs. That data stays on their servers, and we do not receive it. See section 6.

• Visiting ottsa.com. The site has no analytics and no tracking. Like any web server, the one that serves it keeps access logs: your IP address, browser and the pages you request.
• Messages you send us. Through the contact form, we receive the topic, your name and email address, and the company, website, current billing platform, number of clients and message you provide. Each message becomes a ticket in our help desk on my.ottsa.com, and emails you send us are kept in the same way.
• The security check on the contact form. Cloudflare Turnstile checks that a person, not a bot, is sending the message. To do this, Cloudflare processes your IP address and information about your browser.
• Your account on my.ottsa.com. Your name, email address, company, billing address, VAT number, password (stored as a one-way hash), two-factor settings, and the users you give access to your account.
• Orders and payments. The licenses you order, your invoices and payments. Payments are handled by the payment provider you choose at checkout. If you save a card, we keep the provider's token with the card's brand, last four digits and expiry date, never the full card number.
• License checks. A licensed install regularly sends our license server its license key, an install ID, its domain, the folder it runs in, and its Ottsa and PHP versions. Our server also sees the IP address it connects from.
• Support. Your tickets and their attachments. If you give us access to your install for a support request, we see only what that request needs.
• Affiliate program. Visits to your affiliate links, recorded with a hash of the visitor's IP address (never the address itself), the page they landed on and the site they came from; the customers you refer, their payments and your commissions; and the payout details you give us, such as a PayPal address or bank account.
• Security logs. Sign-ins to my.ottsa.com, with their IP address and browser, and the actions taken in your account.

• To answer your messages and provide support.
• To run your account, sell and renew your licenses, and keep the records tax and accounting law requires.
• To check licenses, prevent their misuse, and offer your install the updates its license covers.
• To run the affiliate program: recording referrals, calculating commissions and paying them.
• To keep our website, my.ottsa.com and our license and update servers secure.
• To tell you about your licenses, invoices, updates and security notices.
• To send product news and offers, only if you have agreed to receive them. See section 13.

We do not sell personal data, and we do not use it for advertising.

Under the GDPR, we rely on these legal bases:

Ottsa runs on our customers' own hosting. The data they keep about their clients, such as client records, services, invoices and tickets, stays on their servers. We do not receive it, and the license check does not send it. Each hosting company is the controller of its clients' data.

If a customer gives us access to their install for a support request, we see only what that request needs, act on their instructions, and keep it confidential, as our Terms of Service describe.

If you are a client of a hosting company that uses Ottsa and want to access or delete your data, please contact that company. We cannot see or change it.

We share personal data only with providers that help us run our business, under contracts that limit how they can use it:

• Hosting: the providers that host ottsa.com, my.ottsa.com and our license and update servers, with their backups.
• Email: the provider that delivers our emails.
• Payments: the payment provider you choose at checkout, which handles your payment under its own privacy policy.
• Security check: Cloudflare, for Turnstile on the contact form.

You can ask [email protected] for the current list of providers. We may also disclose data when the law requires it, to protect the rights and safety of others, or as part of a merger or acquisition, in which case this policy continues to apply to it.

Some of our providers may process personal data outside the European Economic Area. When they do, we protect it with an adequacy decision of the European Commission, its Standard Contractual Clauses, or another approved transfer mechanism.

Backups are deleted on their normal rotation.

my.ottsa.com runs on Ottsa itself: data travels over HTTPS, sensitive settings and payment tokens are encrypted, our staff sign in with two-factor authentication, and sign-ins and changes are logged. Read more on our security page.

If we become aware of a breach that affects your personal data, we will tell you without undue delay and, where required, notify the supervisory authority.

Depending on where you live, you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong or incomplete;
• delete your data, unless we need to keep it by law;
• send your data to you or another provider in a portable format;
• restrict or object to how we use it, including for direct marketing;
• withdraw your consent, where we rely on it.

You can change most account details yourself on my.ottsa.com. For anything else, email [email protected]. We reply within one month and may ask you to confirm your identity first.

You also have the right to complain to a data protection authority. In Romania, that is the National Supervisory Authority for Personal Data Processing (ANSPDCP). We would appreciate the chance to resolve your concern first.

• ottsa.com. The site sets no cookies. It remembers whether you chose light or dark mode, and that you closed the cookie notice, in your browser's local storage, which never leaves your device. If you arrive through an affiliate link, its code is carried along on the links you click; nothing is stored.
• my.ottsa.com. Essential cookies keep you signed in, remember your choices and protect forms against misuse. If you arrive through an affiliate link, a cookie remembers that link for 90 days so the affiliate is credited if you order.
• The contact form. Cloudflare Turnstile may use its own storage to run its check, under Cloudflare's privacy policy.

You can clear cookies and local storage in your browser settings at any time.

We send service emails about your account, licenses, invoices, support tickets and security. You cannot opt out of these while your account is open, because we need them to serve you.

Product news and offers are optional and are sent only with your consent. You can change your choice in your account on my.ottsa.com at any time.

Ottsa is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us their data, contact us and we will delete it.

We update this page when our practices change and revise the date at the top. If a change is significant, we will also email account owners before it takes effect.

Questions about this policy or your data: [email protected]. Ottsa, Bucharest, Romania.