Otterly.AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “The operating company of Hotjar is Hotjar Limited, Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta.” | Captured 2026-06-09Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Furthermore, in exercising his or her right to data portability pursuant to Article 20(1) of the GDPR, the data subject shall have the right to have personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.” | Captured 2026-06-09Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Furthermore, the data subject shall have a right to obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “- The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.” | Captured 2026-08-14Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “Each data subject shall have the right granted by the European legislator to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies, as long as the processing is not necessary:” | Captured 2026-08-14Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “The criteria used to determine the period of storage of personal data is the respective statutory retention period. After expiration of that period, the corresponding data is routinely deleted, as long as it is no longer necessary for the fulfillment of the contract or the initiation of a contract.” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “By registering on the website of the controller, the IP address—assigned by the Internet service provider (ISP) and used by the data subject—date, and time of the registration are also stored. The storage of this data takes place against the background that this is the only way to prevent the misuse of our services, and, if necessary, to make it possible to investigate committed offenses. Insofar, the storage of this data is necessary to secure the controller. This data is not passed on to third parties unless there is a statutory obligation to pass on the data, or if the transfer serves the aim of criminal prosecution.” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “- The personal data have been unlawfully processed.” | Captured 2026-08-14Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “If the storage purpose is not applicable, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “- The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “- The data subject withdraws consent to which the processing is based according to point (a) of Article 6(1) of the GDPR, or point (a) of Article 9(2) of the GDPR, and where there is no other legal ground for the processing.” | Captured 2026-08-14Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “Where the controller has made personal data public and is obliged pursuant to Article 17(1) to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required. An employees of the TheCompany will arrange the necessary measures in individual cases.” | Captured 2026-08-14Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “The data controller shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of storage, or as far as this is granted by the European legislator or other legislators in laws or regulations to which the controller is subject to.” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “- The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “During the registration for the newsletter, we also store the IP address of the computer system assigned by the Internet service provider (ISP) and used by the data subject at the time of the registration, as well as the date and time of the registration. The collection of this data is necessary in order to understand the (possible) misuse of the e-mail address of a data subject at a later date, and it therefore serves the aim of the legal protection of the controller.” | Captured 2026-08-14Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by the TheCompany, he or she may, at any time, contact any employee of the controller. An employee of TheCompany shall promptly ensure that the erasure request is complied with immediately.” | Captured 2026-08-14Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “- The data subject objects to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR.” | Captured 2026-08-14Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “If the data subject is logged in on YouTube, YouTube recognizes with each call-up to a sub-page that contains a YouTube video, which specific sub-page of our Internet site was visited by the data subject. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “On this website, the controller has integrated components of YouTube. YouTube is an Internet video portal that enables video publishers to set video clips and other users free of charge, which also provides free viewing, review and commenting on them. YouTube allows you to publish all kinds of videos, so you can access both full movies and TV broadcasts, as well as music videos, trailers, and videos made by users via the Internet portal.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.com/intl/en/policies/privacy/ and under http://www.google.com/analytics/terms/us.html. Google Analytics is further explained under the following Link https://www.google.com/analytics/.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “The operating company of this Amazon component is Amazon EU S.à.r.l, 5 Rue Plaetis, L-2338 Luxembourg, Luxembourg.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “On this website, the controller has integrated Google AdWords. Google AdWords is a service for Internet advertising that allows the advertiser to place ads in Google search engine results and the Google advertising network. Google AdWords allows an advertiser to pre-define specific keywords with the help of which an ad on Google's search results only then displayed, when the user utilizes the search engine to retrieve a keyword-relevant search result. In the Google Advertising Network, the ads are distributed on relevant web pages using an automatic algorithm, taking into account the previously defined keywords.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which a YouTube component (YouTube video) was integrated, the Internet browser on the information technology system of the data subject is automatically prompted to download a display of the corresponding YouTube component. Further information about YouTube may be obtained under https://www.youtube.com/yt/about/en/. During the course of this technical procedure, YouTube and Google gain knowledge of what specific sub-page of our website was visited by the data subject.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “The applicable data protection provisions of Stripe may be retrieved under https://www.Stripe.com/us/webapps/mpp/ua/privacy-full.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “The operating company of the Google Remarketing services is the Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The applicable data protection provisions of Twitter may be accessed under https://twitter.com/privacy?lang=en.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “With each call-up to one of the individual pages of this Internet website, which is operated by the controller and into which a Facebook component (Facebook plug-ins) was integrated, the web browser on the information technology system of the data subject is automatically prompted to download display of the corresponding Facebook component from Facebook through the Facebook component. An overview of all the Facebook Plug-ins may be accessed under https://developers.facebook.com/docs/plugins/. During the course of this technical procedure, Facebook is made aware of what specific sub-site of our website was visited by the data subject.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “If the data subject chooses "Stripe" as the payment option in the online shop during the ordering process, we automatically transmit the data of the data subject to Stripe. By selecting this payment option, the data subject agrees to the transfer of personal data required for payment processing.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The operating company of Stripe is Stripe Inc., US” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “A social network is a place for social meetings on the Internet, an online community, which usually allows users to communicate with each other and interact in a virtual space. A social network may serve as a platform for the exchange of opinions and experiences, or enable the Internet community to provide personal or business-related information. Facebook allows social network users to include the creation of private profiles, upload photos, and network through friend requests.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Some services use OpenAI to serve the user with intelligent answers, which is operated by the controller and on which an OpenAI component was integrated, content of the data subject is automatically promptedt. Further information about OpenAI may be obtained under https://openai.com/policies/privacy-policy. During the course of this technical procedure, OpenAI gains knowledge of what specific content was submitting by the data subject.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “On this website, the controller has integrated Amazon components as a participant in the Amazon partner program. The Amazon components were created by Amazon with the aim to mediate customers through advertisements on various websites of the Amazon group, in particular Amazon.co.uk, Local.Amazon.co.uk, Amazon.de, BuyVIP.com, Amazon.fr, Amazon.it and Amazon.es in return for the payment of a commission. By using the Amazon components, the controller may generate advertising revenue.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The operating company of OpenAI, is done by OpenAI Inc, US.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Hotjar's data protection provisions, available at https://www.hotjar.com/legal, provide information about the collection, processing and use of personal data by Hotjar.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The operating company of rb2b, is done by GetEmails, LLC dba Retention.com / 1401 Lavaca Street / Unit #298 / Austin, TX 78701.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “On this website, the controller has integrated components of OpenAI. OpenAI is an AI API that can process text and videos and images and apply artificial intelligence on it.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The purpose of Google AdWords is the promotion of our website by the inclusion of relevant advertising on the websites of third parties and in the search engine results of the search engine Google and an insertion of third-party advertising on our website.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Further information and the actual data protection provisions of Amazon may be retrieved under https://www.amazon.de/gp/help/customer/display.html?nodeId=3312401&language=en\_GB.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Further information and the actual data protection provisions of Google may be retrieved under https://www.google.com/intl/en/policies/privacy/.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “YouTube's data protection provisions, available at https://www.google.com/intl/en/policies/privacy/, provide information about the collection, processing and use of personal data by YouTube and Google.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “The transmission of the data is aimed at payment processing and fraud prevention. The controller will transfer personal data to Stripe, in particular, if a legitimate interest in the transmission is given. The personal data exchanged between Stripe and the controller for the processing of the data will be transmitted by Stripe to economic credit agencies. This transmission is intended for identity and creditworthiness checks.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “On this website, the controller has integrated components of the enterprise Facebook. Facebook is a social network.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which a Twitter component (Twitter button) was integrated, the Internet browser on the information technology system of the data subject is automatically prompted to download a display of the corresponding Twitter component of Twitter. Further information about the Twitter buttons is available under https://about.twitter.com/de/resources/buttons. During the course of this technical procedure, Twitter gains knowledge of what specific sub-page of our website was visited by the data subject. The purpose of the integration of the Twitter component is a retransmission of the contents of this website to allow our users to introduce this web page to the digital world and increase our visitor numbers.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Facebook always receives, through the Facebook component, information about a visit to our website by the data subject, whenever the data subject is logged in at the same time on Facebook during the time of the call-up to our website. This occurs regardless of whether the data subject clicks on the Facebook component or not. If such a transmission of information to Facebook is not desirable for the data subject, then he or she may prevent this by logging off from their Facebook account before a call-up to our website is made.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.com/intl/en/policies/privacy/.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Twitter receives information via the Twitter component that the data subject has visited our website, provided that the data subject is logged in on Twitter at the time of the call-up to our website. This occurs regardless of whether the person clicks on the Twitter component or not. If such a transmission of information to Twitter is not desirable for the data subject, then he or she may prevent this by logging off from their Twitter account before a call-up to our website is made.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The operating company of Twitter is Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, UNITED STATES.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The purpose of Google Remarketing is the insertion of interest-relevant advertising. Google Remarketing allows us to display ads on the Google network or on other websites, which are based on individual needs and matched to the interests of Internet users.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “On this website, the controller has integrated Google Remarketing services. Google Remarketing is a feature of Google AdWords, which allows an enterprise to display advertising to Internet users who have previously resided on the enterprise's Internet site. The integration of Google Remarketing therefore allows an enterprise to create user-based advertising and thus shows relevant advertisements to interested Internet users.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Hotjar will receive information through the Hotjar component that the data subject has visited our website.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “On this website, the controller has integrated components of rb2b. rb2b is an lead identification system only in the United States that can identify leads on the website.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The operating company of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, UNITED STATES. The YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, UNITED STATES.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “On this website, the controller has integrated components of Twitter. Twitter is a multilingual, publicly-accessible microblogging service on which users may publish and spread so-called 'tweets,' e.g. short messages, which are limited to 280 characters. These short messages are available for everyone, including those who are not logged on to Twitter. The tweets are also displayed to so-called followers of the respective user. Followers are other Twitter users who follow a user's tweets. Furthermore, Twitter allows you to address a wide audience via hashtags, links or retweets.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “The operating company of Google AdWords is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, UNITED STATES.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “YouTube and Google will receive information through the YouTube component that the data subject has visited our website, if the data subject at the time of the call to our website is logged in on YouTube; this occurs regardless of whether the person clicks on a YouTube video or not. If such a transmission of this information to YouTube and Google is not desirable for the data subject, the delivery may be prevented if the data subject logs off from their own YouTube account before a call-up to our website is made.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “On this website, the controller has integrated components of Stripe. Stripe is an online payment service provider. Payments are processed via so-called Stripe accounts, which represent virtual private or business accounts. Stripe is also able to process virtual payments through credit cards when a user does not have a Stripe account. A Stripe account is managed via an e-mail address, which is why there are no classic account numbers. Stripe makes it possible to trigger online payments to third parties or to receive payments. Stripe also accepts trustee functions and offers buyer protection services.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “The personal data transmitted to Stripe is usually first name, last name, address, email address, IP address, telephone number, mobile phone number, or other data necessary for payment processing. The processing of the purchase contract also requires such personal data, which are in connection with the respective order.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “- the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Stripe will, if necessary, pass on personal data to affiliates and service providers or subcontractors to the extent that this is necessary to fulfill contractual obligations or for data to be processed in the order.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Google Fonts will receive information through the Google Font component that the data subject has visited our website.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “By using OtterlyAI, you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Information accessed through YouTube API Services is also subject to the Google Privacy Policy (https://policies.google.com/privacy).” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “The operating company of Google's AdSense component is Alphabet Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “OtterlyAI uses YouTube API Services to retrieve publicly available metadata - such as a video’s title, channel name, and publication date - for YouTube videos that AI search engines cite as sources within the AI-generated answers we monitor on your behalf. We do not access any private YouTube account data, and we do not act on behalf of any YouTube user account.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “On this website, the controller has integrated components of Youtube API Services.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “The data protection guideline published by Facebook, which is available at https://facebook.com/about/privacy/, provides information about the collection, processing and use of personal data by Facebook. In addition, it is explained there what setting options Facebook offers to protect the privacy of the data subject. In addition, different configuration options are made available to allow the elimination of data transmission to Facebook. These applications may be used by the data subject to eliminate a data transmission to Facebook.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “The operating company of Facebook is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, United States. If a person lives outside of the United States or Canada, the controller is the Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.” | Captured 2026-06-09Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.