GDPR Compliance

Ottimo is committed to protecting the privacy rights of individuals in the European Union and European Economic Area. This page outlines how we comply with the General Data Protection Regulation (GDPR) and what rights you have as a data subject.

For users in the EU/EEA, Ottimo, Inc. acts as the data controller for your personal data. Our designated contact for GDPR matters is privacy@ottimo.dev.

We process your personal data under the following legal bases:

• Contract performance — processing necessary to provide the Ottimo service you've subscribed to.
• Legitimate interests — product improvement, security monitoring, and fraud prevention.
• Legal obligation — where we are required to process data by applicable law.
• Consent — for optional features like marketing communications, where we ask for your explicit agreement.

As an EU/EEA resident, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data ("right to be forgotten").
• Right to restrict processing — request that we limit how we use your data in certain circumstances.
• Right to data portability — receive your data in a machine-readable format for transfer to another service.
• Right to object — object to processing based on legitimate interests.
• Rights related to automated decision-making — request human review of any automated decisions that significantly affect you.

To exercise any of these rights, email privacy@ottimo.dev. We will respond within 30 days. If we need more time for complex requests, we will notify you.

Ottimo is based in the United States. When we transfer data from the EU/EEA to the US, we rely on Standard Contractual Clauses (SCCs) and ensure our sub-processors provide equivalent protection. A full list of sub-processors is available upon request.

We retain personal data only as long as necessary for the purposes described in our Privacy Policy. Account data is deleted within 90 days of account termination. Certain data may be retained longer where required by law.

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your local Data Protection Authority (DPA). In the EU, you can find your relevant DPA at edpb.europa.eu.

For GDPR-related inquiries, contact our privacy team at privacy@ottimo.dev. We do not currently have a formally designated DPO but are committed to handling all privacy requests promptly and thoroughly.