Marketing / Content · otterly-ai.comOtterly.AI
Graded against 1172 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
Partially verified: Privacy Policy assessed · Terms of Service pending. Everything below comes only from what was read in full.
Watch: Privacy and data use
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Restricts use of newsletter registration personal data solely to sending the newsletter and related operational communications, and expressly prohibits transfer of that data to third parties; also describes the data subject's right to terminate the subscription.
Establishes that personal data voluntarily transmitted by a data subject via email or contact form will be automatically stored for the purpose of processing or contacting the data subject, and states there is no transfer of this data to third parties.
Discloses the categories of general data and information collected when users access the website and stored in server log files, including browser type, operating system, referrer, IP address, and other technical access data.
How to read this page: Overall risk rates what Otterly.AI's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredIP/output assessment pending — terms of service not yet verified This lens receives a band only once its source document has been captured and read in full.
Know where this document lives? Point us to the URL or PDF and the pipeline will verify it.
Based on 236 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Partially verified — Terms of Service — Capture under review; Privacy Policy — Verified (read in full, 146 findings). Findings below are from fully-read, verified documents only; remaining core documents are pending capture.
Needs review
A core policy document is captured but requires review before AIRIN can mark the corpus fully verified.
- Terms of ServiceCompleteness unconfirmedstatic
- Privacy PolicyVerified - read in full - 146 citationsfirecrawlLast captured 2026-08-14
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Identifies Facebook as an enterprise whose components have been integrated into the website by the controller, establishing it as a relevant subprocessor relationship.
"On this website, the controller has integrated components of the enterprise Facebook. Facebook is a social network."
States the purposes for which collected general data and information are used — website delivery, content optimization, IT system viability, and law enforcement cooperation in cyber-attack cases — and restricts its use to statistical anonymous analysis without drawing conclusions about individual data subjects.
"When using these general data and information, the TheCompany does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our website correctly, (2) optimize the content of our webs..."
Describes what Stripe is, how it operates (via accounts, credit cards, e-mail addresses), and the types of payment services it provides, establishing the context and nature of the subprocessor relationship.
"On this website, the controller has integrated components of Stripe. Stripe is an online payment service provider. Payments are processed via so-called Stripe accounts, which represent virtual private or business accounts. Stripe is also ab..."
Defines what Google Remarketing is and describes how the controller has integrated it to display targeted advertising to prior website visitors, establishing the context for subsequent data-sharing disclosures.
"On this website, the controller has integrated Google Remarketing services. Google Remarketing is a feature of Google AdWords, which allows an enterprise to display advertising to Internet users who have previously resided on the enterprise..."
Describes the procedure by which users subscribe to the newsletter and identifies the input mask as the mechanism that determines what personal data are transmitted at the time of ordering.
"On the website of the TheCompany, users are given the opportunity to subscribe to our enterprise's newsletter. The input mask used for this purpose determines what personal data are transmitted, as well as when the newsletter is ordered fro..."
Discloses that the advertising component sets cookies on the data subject's system enabling the third-party operator to analyze website usage, and that data is automatically submitted via the browser when pages are loaded.
"The purpose of Google's AdSense component is the integration of advertisements on our website. Google AdSense places a cookie on the information technology system of the data subject. The definition of cookies is explained above. With the s..."
Defines the nature of a social network and describes the functionality of Facebook as a platform, contextualising why personal data flows to this subprocessor.
"A social network is a place for social meetings on the Internet, an online community, which usually allows users to communicate with each other and interact in a virtual space. A social network may serve as a platform for the exchange of op..."
Disclaims that absolute security of internet-based data transmissions cannot be guaranteed despite implemented technical and organisational measures, while noting that data subjects may use alternative means such as telephone to transfer personal data, limiting the company's liability for transmission security gaps.
"As the controller, the TheCompany has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in princ..."
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
"The personal data collected as part of a registration for the newsletter will only be used to send our newsletter. In addition, subscribers to the newsletter may be informed by e-mail, as long as this is necessary for the operation of the newsletter service or a registration in question, as this could be the case in the event of modifications to the newsletter offer, or in the event of a change in technical circumstances. There will be no transfer of personal data collected by the newsletter service to third parties. The subscription to our newsletter may be terminated by the data subject at any time. The consent to the storage of personal data, which the data subject has given for shipping the newsletter, may be revoked at any time. For the purpose of revocation of consent, a corresponding link is found in each newsletter. It is also possible to unsubscribe from the newsletter at any time directly on the website of the controller, or to communicate this to the controller in a different way."
Restricts use of newsletter registration personal data solely to sending the newsletter and related operational communications, and expressly prohibits transfer of that data to third parties; also describes the data subject's right to terminate the subscription.
AI-generated interpretation, not legal advice.
"The website of the TheCompany contains information that enables a quick electronic contact to our company, as well as direct communication with us, which also includes a general address of the so-called electronic mail (e-mail address). If a data subject contacts the controller by e-mail or via a contact form, the personal data transmitted by the data subject are automatically stored. Such personal data transmitted on a voluntary basis by a data subject to the data controller are stored for the purpose of processing or contacting the data subject. There is no transfer of this personal data to third parties."
Establishes that personal data voluntarily transmitted by a data subject via email or contact form will be automatically stored for the purpose of processing or contacting the data subject, and states there is no transfer of this data to third parties.
AI-generated interpretation, not legal advice.
"Through Google AdSense, personal data and information—which also includes the IP address, and is necessary for the collection and accounting of the displayed advertisements—is transmitted to Alphabet Inc. in the United States of America. These personal data will be stored and processed in the United States of America. The Alphabet Inc. may disclose the collected personal data through this technical procedure to third parties."
Discloses that personal data including IP addresses is transmitted to and stored by the third-party operator in another country, and that the operator may further disclose the data to third parties.
AI-generated interpretation, not legal advice.
"The website of the TheCompany collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are stored in the server log files. Collected may be (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites, (5) the date and time of access to the Internet site, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on our information technology systems."
Discloses the categories of general data and information collected when users access the website and stored in server log files, including browser type, operating system, referrer, IP address, and other technical access data.
AI-generated interpretation, not legal advice.
"Stripe will, if necessary, pass on personal data to affiliates and service providers or subcontractors to the extent that this is necessary to fulfill contractual obligations or for data to be processed in the order."
Grants the data subject the right to revoke consent for Stripe's handling of personal data at any time, while noting that revocation does not affect data that must be processed for contractual payment purposes.
AI-generated interpretation, not legal advice.
"Such personal data collected in the tracking pixels contained in the newsletters are stored and analyzed by the controller in order to optimize the shipping of the newsletter, as well as to adapt the content of future newsletters even better to the interests of the data subject. These personal data will not be passed on to third parties. Data subjects are at any time entitled to revoke the respective separate declaration of consent issued by means of the double-opt-in procedure. After a revocation, these personal data will be deleted by the controller. The TheCompany automatically regards a withdrawal from the receipt of the newsletter as a revocation."
Restricts use of tracking pixel data to newsletter optimization and content adaptation, prohibits passing it to third parties, grants data subjects the right to revoke consent at any time, and obligates deletion of tracking data upon revocation.
AI-generated interpretation, not legal advice.
"The operating company of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, UNITED STATES. The YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, UNITED STATES."
Identifies the operating company of YouTube and its parent company, including addresses, establishing the legal entities involved in data processing through the embedded component.
AI-generated interpretation, not legal advice.
"Further information and the actual data protection provisions of Amazon may be retrieved under https://www.amazon.de/gp/help/customer/display.html?nodeId=3312401&language=en\_GB."
Incorporates by reference the external data protection provisions of a third-party service by providing a URL link to those policies.
AI-generated interpretation, not legal advice.
"- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed."
Specifies one ground triggering the right to erasure: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
AI-generated interpretation, not legal advice.
"On this website, the controller has integrated components of the enterprise Facebook. Facebook is a social network."
Identifies Facebook as an enterprise whose components have been integrated into the website by the controller, establishing it as a relevant subprocessor relationship.
AI-generated interpretation, not legal advice.
"Furthermore, the data subject shall have a right to obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer."
Grants the data subject the right to know whether their personal data are transferred to a third country or international organisation, and if so, to be informed of the safeguards in place for that transfer.
AI-generated interpretation, not legal advice.
"On this website, the controller has integrated the component of Google Analytics (with the anonymizer function). Google Analytics is a web analytics service. Web analytics is the collection, gathering, and analysis of data about the behavior of visitors to websites. A web analysis service collects, inter alia, data about the website from which a person has come (the so-called referrer), which sub-pages were visited, or how often and for what duration a sub-page was viewed. Web analytics are mainly used for the optimization of a website and in order to carry out a cost-benefit analysis of Internet advertising."
Defines web analytics and the nature of the analytics component integrated on the website, describing what categories of data are collected about visitor behavior.
AI-generated interpretation, not legal advice.
"We use cookies to improve your experience. By using our site, you agree to our [terms and conditions](https://otterly.ai/app/?page=terms#dataprivacy)."
This cookie consent notice states that by using the site the user agrees to the linked terms and conditions (which include data privacy provisions), imposing a consent-based obligation on the user and conditioning site use on acceptance of those terms.
AI-generated interpretation, not legal advice.
"Each data subject shall have the right granted by the European legislator not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her, as long as the decision (1) is not is necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) is not authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) is not based on the data subject's explicit consent."
Grants data subjects the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, subject to exceptions for contractual necessity or authorisation by applicable law with appropriate safeguards.
AI-generated interpretation, not legal advice.
"- The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use instead."
Specifies a condition triggering the right to restriction of processing where processing is unlawful and the data subject opposes erasure and requests restriction of use instead.
AI-generated interpretation, not legal advice.
"Amazon sets a cookie the information technology system of the data subject. The definition of cookies is explained above. With each single call-up to one of the individual pages of this Internet website, which is operated by the controller and in which an Amazon component was integrated, the Internet browser on the information technology system of the data subject will automatically submit data for the purpose of online advertising and the settlement of commissions to Amazon through the respective Amazon component. During the course of this technical procedure, Amazon receives personal information that is used to trace the origin of orders from Amazon, and as a result, to allow the accounting of a commission. Among other things, Amazon may understand that the data subject has clicked on an affiliate link on our website."
Discloses that Amazon sets cookies on the data subject's device and that each page visit causes the browser to automatically transmit personal data to Amazon for online advertising and commission settlement purposes through the integrated Amazon component.
AI-generated interpretation, not legal advice.
"If a data subject decides to subscribe to the option, the controller will send an automatic confirmation e-mail to check the double opt-in procedure as to whether the owner of the specified e-mail address decided in favor of this option. The option to subscribe to comments may be terminated at any time."
Establishes a double opt-in confirmation procedure for comment subscriptions and grants the data subject the right to terminate the subscription at any time.
AI-generated interpretation, not legal advice.
"YouTube and Google will receive information through the YouTube component that the data subject has visited our website, if the data subject at the time of the call to our website is logged in on YouTube; this occurs regardless of whether the person clicks on a YouTube video or not. If such a transmission of this information to YouTube and Google is not desirable for the data subject, the delivery may be prevented if the data subject logs off from their own YouTube account before a call-up to our website is made."
States that YouTube and Google receive visit information regardless of whether a video is clicked, and provides a user-facing opt-out procedure (logging off from YouTube account) to prevent that transmission.
AI-generated interpretation, not legal advice.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Otterly.AI's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Know where the missing document lives?
We haven't yet verified Otterly.AI's Terms of Service. Point us at the official page and our pipeline will attempt to capture and read it in full. Submissions are candidates only — nothing is published until it passes the same verification gates as every other document on this site.
Every finding above is a verbatim quote from Otterly.AI's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.