Privacy policy
What data Otus processes about you, why, for how long, and your rights.
Version of 22 October 2026
1. Who is responsible
Stéphane Parra, publisher of Otus (see the legal notice), is the controller of the processing described here. Contact: contact@otus.pro.
This policy covers the data of our users, of the people who join our waiting list and of visitors to otus.pro. The data our users manage in Otus about their own clients and Buyers is theirs: Otus only processes it on their behalf (see the data processing agreement). If you are a client of an Otus user, please contact them.
2. The data, why, and on what basis
| Data | Why | Legal basis |
|---|---|---|
| Account: name, e-mail, hashed password, language, two-factor authentication | Create and secure your account, sign you in | Performance of the contract |
| Workspace: business name, country, currency, contact details, legal numbers, plan | Provide the service, print your documents | Performance of the contract |
| Subscription: plan, terms, invoices (the payment itself is handled by Stripe) | Invoice and keep our accounts | Contract and legal obligation |
| Messages you send us | Answer you | Legitimate interest |
| Waiting list: e-mail | Tell you when we open | Consent |
| Technical logs: IP address, device, pages requested | Run and secure the service | Legitimate interest |
We never sell your data, never use it for advertising and do not profile you.
3. For how long
- Account and workspace: as long as the account exists, then 30 days for you to export, then deletion. A Solo workspace nobody has signed in to for 12 months may be closed, after a warning e-mail 30 days before.
- Subscription invoices: ten years, as French commercial law requires.
- Waiting list: until the beta opens and at most six months after, or until you unsubscribe.
- Messages: three years after the last exchange.
- Technical logs: a few weeks at most, depending on our hosts.
4. Who receives it
Your data is only accessible to the publisher and to the providers the service needs, each for its own role only:
| Provider | Role | Where |
|---|---|---|
| Supabase | Database, accounts, files | European Union |
| Vercel | Hosting of the website and the app | European Union (Ireland); US company |
| Resend | Sending e-mails | European Union (Ireland); US company |
| Stripe | Payments, subscriptions, connected accounts | European Union and United States |
| Sign in with Google, if you choose it | United States | |
| DeepL | Translating your product pages, if you ask | Germany |
| Company directory (French State) | Finding a business by its SIREN | France |
| VIES (European Commission) | Checking a VAT number | European Union |
| Super PDP (SUPER G, Paris) | Approved platform: your e-invoices and reports, if you turn them on; looking a business up in the French State's directory | France |
| Brandfetch | Showing a supplier's logo in your expenses | Switzerland (Brandfetch SA) |
When a provider transfers data outside the European Union, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
6. Security
Exchanges are encrypted (HTTPS). Each workspace is isolated in the database: its data can only be read by its members. Passwords are never stored in clear. Two-factor authentication is available, and sensitive actions are logged.
7. Your rights
You can access your data, correct it, erase it, receive it in an open format (the export in the settings does it in one click), object to processing based on our legitimate interest, ask for it to be restricted, withdraw your consent at any time and set instructions for what happens to it after your death.
Write to contact@otus.pro: we answer within one month. You can also complain to the French data protection authority, the CNIL (cnil.fr), or to the authority of your country.
8. Changes
We may update this policy. The version date is at the top of the page; any significant change is announced to you by e-mail.