Privacy policy.

Controller

{{COMPANY_LEGAL_NAME}}
{{STREET_ADDRESS}}
{{POSTAL_CODE_CITY}}
Email: hello@otto.photography

Purposes of processing

• Providing the platform (user accounts, magic-link sign-in)
• Processing payments (Stripe)
• Running catalog production (image generation, copy generation, shop publishing)
• Customer communication (transactional email, support)
• Website analytics (Plausible — GDPR-compliant, cookieless)

Processors

Otto uses the following processors under Art. 28 GDPR:

• Stripe Payments Europe, Limited (Ireland) — payment processing
• Fly.io (Frankfurt, DE) — application hosting
• SiteGround Spain S.L. (Spain) — SMTP delivery
• Google Ireland Limited (EU region) — Gemini API (image generation, vision)
• Anthropic PBC (USA) — Claude API (text generation; standard contractual clauses)
• Plausible Insights OÜ (Estonia) — website analytics

Retention

• Invoicing data: 10 years under Austrian commercial law (UGB)
• Customer account: until deleted by the user
• Generated product images: deletable on request; otherwise kept until account closure
• Plausible data: aggregated, anonymised metrics with no personal reference

Data subject rights

You have the right to access, correction, erasure, restriction of processing, data portability, objection, and to lodge a complaint with a supervisory authority.

For requests: hello@otto.photography with subject GDPR. Reply within 30 days.

Transfers to third countries

Data is transferred to the USA only via Anthropic (text generation). Legal basis: EU standard contractual clauses under Art. 46(2)(c) GDPR.

Cookies

Otto does not set tracking cookies. Plausible works without cookies. For user authentication, a purely technical session cookie is set (sr_session, HttpOnly, Secure, SameSite=Lax).

Supervisory authority

Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.