Privacy Policy

This platform (investors.ootaos.com, the “Investor Room”) is operated by OotaOS Platform Services Private Limited, a company incorporated under the Companies Act, 2013 of India, with its registered office in Bengaluru, Karnataka (“OotaOS”, “we”, “us”). We are the data controller (GDPR) and data fiduciary (India's DPDP Act, 2023) for the personal data described here. Questions and requests: info@ootaos.com.

• Identity details — your name, title, firm, and email address, when you sign the NDA, book a founder call, or when we invite you.
• NDA signature records — the signed agreement, signature timestamp, and the IP address and browser user-agent captured at signing (these form the legal execution record).
• Concierge conversations — questions you ask Olivia, our AI concierge, and the answers given, kept briefly to improve answer quality.
• Meeting details — times you book, your timezone, and any agenda notes you add.
• Access and security logs — IP address, user agent, and timestamps of access, kept to protect the service and the confidential materials in it.
• Usage analytics— which pages of this investor room you open, how long each page is in view, how far you scroll, and what you click. We derive an approximate location (city or region) from your browser's timezone setting rather than looking up your IP address against a geolocation database. This is first-party only: the data stays in our own database, is never sold or shared with advertisers, and no third-party analytics script runs on this site.
• Cookies — essential session cookies only (your private access link and NDA session). We use no advertising or cross-site tracking cookies, so there is no cookie banner to click.

• To operate your private investor room: your access link, the data room, and document delivery.
• To execute and evidence the mutual NDA, and to enforce it if required.
• To answer your questions through the AI concierge, using our own company materials.
• To schedule, confirm, and remind you about founder meetings.
• To secure the platform: rate limiting, abuse prevention, and audit trails.
• To meet legal obligations that apply to us.

Where GDPR applies, we rely on performance of a contract (the NDA and your requested access), legitimate interests (running and securing an invite-only fundraising platform), consent (where you ask us for something optional), and legal obligation. Under India's DPDP Act we process your data with your consent and for legitimate uses connected to the access you request.

• We never sell your personal data. To anyone.
• We never use your questions or data to train foundation AI models.
• We never run third-party advertising or tracking on this platform.
• We never share your identity outside the processors listed below and the founding team.

We use a small number of infrastructure providers to run the platform, each bound by contractual data-protection terms:

• Railway — application and database hosting (EU-West region).
• Anthropic — AI processing for the concierge (United States). Your questions are processed to generate answers and are not used to train models.
• Zoho / ZeptoMail — transactional email delivery (India).
• Google — meeting rooms and calendar events when you book a call.

Because these providers operate in different countries, your data may be transferred internationally. Where required, we rely on the safeguards in our agreements with these providers (including standard contractual clauses where applicable).

• NDA records: the duration of the fundraise plus seven (7) years — they are legal execution records.
• Concierge conversations: thirty (30) days, then deleted or anonymized.
• Access and security logs: up to twelve (12) months.
• Usage analytics: twelve (12) months, in aggregate form thereafter.
• Identity and meeting records: the life of our relationship with you, or until you ask us to delete them.

Subject to applicable law, you can ask us to access, correct, delete, or export your personal data; object to or restrict certain processing; and withdraw consent where processing is based on it. Email info@ootaos.com — we respond within seven (7) days. You may also lodge a complaint with your local supervisory authority (for EU/UK residents) or the Data Protection Board of India. Deleting NDA execution records before their retention period ends may not be possible where we are legally required to keep them.

All traffic is encrypted in transit. Access to the data room is gated by unique private links, email verification, and the NDA; administrative access is limited to the founding team with authentication and audit logging. No system is perfectly secure — if we become aware of a breach affecting your data, we will notify you as required by law.

This platform is for professional investors and is not directed at anyone under 18. We do not knowingly collect data from minors.

If we make a material change to this policy, we will email every investor with an active NDA before it takes effect. Questions, requests, or concerns: info@ootaos.com.