OtterPortal

Privacy notice

How Otterportal Handles Information

This Privacy Notice describes how Otterportal handles information when providing the service. It distinguishes Otterportal's own information-handling practices from those of organizations that use Otterportal to receive and manage privacy requests.

Last updated August 2, 2026

Private beta / pre-production notice: This deployment has not configured its legal entity name, legal contact, mailing address, or governing state. Use synthetic or test data only. It must not accept real customer accounts, production personal information, paid subscriptions, or live privacy requests until production readiness is approved.

1. Who Is Responsible

Otterportal operates the Otterportal service and is responsible for the account, billing-relationship, security, and operational information it handles for its own purposes. When billing is enabled, Stripe handles payment and billing information under its own terms and privacy notice; Stripe's privacy role may differ depending on the service and processing activity.

When a person submits a privacy request through a customer's portal, that customer generally determines why and how the request information is used. The customer's name, contact address, and privacy-notice link are displayed in its request portal. Questions about the customer's decisions should be directed to that customer.

The self-service MVP is intended for U.S.-based business customers. A requester's stated location is recorded for the customer's routing and review; Otterportal does not use it to select a law, deadline, or legal outcome.

2. Information We Handle

The information handled depends on how a person uses the service. Merely visiting a public page does not create a workspace or privacy-request record. Workspace information is collected when a person submits an enabled signup form or uses a provisioned account, request information only when a requester submits a live customer portal form, and billing information only when billing is enabled and an authorized user opens Stripe Checkout or the Stripe billing portal.

  • Public-page and network information: an ordinary web request exposes the requested URL, timestamp, IP address, and basic HTTP headers to the hosting edge and application. Otterportal uses the trusted client IP for abuse prevention and stores a SHA-256-derived rate-limit key rather than the raw IP address in its application database. Similar derived keys may be created from email addresses, user or request identifiers, and security tokens. These values are pseudonymous security records, not anonymous data. The hosting platform may retain ordinary access, availability, and security logs under its configured log-retention settings.
  • Workspace and account information: full name, work email, organization name, account role, password, authentication and multi-factor- authentication records, session and trusted-device records, organization and portal configuration, notification and retention settings, templates, and versioned acceptance records for the Terms and this Privacy Notice. Otterportal receives a password to authenticate the user but stores a one-way bcrypt hash rather than the plaintext password. MFA secrets are encrypted; recovery codes, session tokens, and trusted-device tokens are stored as hashes.
  • Billing information when billing is enabled: Otterportal sends Stripe the authorized administrator's work email, the organization's legal or display name, an internal workspace identifier and portal slug, and the selected plan and billing interval. Stripe-hosted pages collect and maintain billing names and addresses, tax jurisdiction and tax identifiers, payment-method details, invoices, payments, refunds, disputes, and related transaction records. Otterportal's active application database stores limited Stripe customer, Checkout-session, subscription, product and price references, subscription dates and status, and webhook-processing records. It does not store full payment-card or bank-account numbers, billing addresses, tax identification numbers, or invoice copies.
  • Privacy-request information: requester full name and email, request type, country or region, optional state or province, optional account ID or username, request details, and later messages. The form also requires confirmation that the information is accurate and that the submitter is the person or is authorized to act for that person; the current application validates that confirmation but does not store a separate copy of the checkbox response.
  • Workflow information: status and activity history, internal notes, organization-configured target dates, verification events, audit events, and delivery records.
  • Operational information: session and authentication-challenge records, hashed rate-limit records, error and security logs, encrypted queued-email content, email delivery status and provider identifiers, Stripe webhook status when billing is enabled, and maintenance and retention records. Production application logs redact fields labeled as passwords, tokens, cookies, email addresses, names, request content, and similar sensitive values, although infrastructure providers may maintain their own request and security logs.
  • Password safety screening: when a person creates or changes a password, Otterportal's server computes a SHA-1 hash and sends only the first five characters of that hash to the Have I Been Pwned Pwned Passwords range service. The full password, complete password hash, name, and email address are not sent to that service.

The current application has no file-upload or identity-document workflow and does not intentionally collect biometric identifiers, government-issued identity documents, precise device location, address-book contacts, advertising identifiers, or payment-card numbers. Free-text request details, messages, notes, and templates can contain information a person chooses to enter, so users should not include passwords, payment-card details, identity-document numbers, or unrelated sensitive information.

3. Where Information Comes From

  • Workspace administrators and users provide account, organization, configuration, note, and message content.
  • Requesters provide their contact details, request information, stated location, and optional account reference.
  • Browsers and the trusted hosting edge provide ordinary HTTP request information and any GPC or DNT preference signal included with the request.
  • Workspace administrators or other authorized billing users provide billing contact, business, address, tax, and payment information through Stripe-hosted billing pages when billing is enabled.
  • The application creates authentication, verification, workflow, delivery, security, and activity records as people use the service.
  • Stripe creates and maintains customer, Checkout, subscription, invoice, payment, tax, and transaction records and returns limited identifiers and status updates used to administer paid subscriptions.
  • Have I Been Pwned returns password-hash range data used to reject known compromised passwords.
  • Render and Resend create or return hosting, database, availability, email-delivery, diagnostic, and security records for the configured production deployment.

4. Why We Handle Information

Otterportal handles information to:

  • create, administer, authenticate, and secure workspace accounts;
  • when billing is enabled, offer and administer subscriptions, collect fees, provide billing-management and invoice access, calculate applicable taxes, address failed payments, and maintain billing records;
  • receive, route, track, and document privacy-request workflows;
  • provide requester tracking and send service and security messages;
  • maintain audit, verification, delivery, and retention records;
  • detect and investigate suspected abuse, unauthorized access, service errors, or delivery failures; and
  • support, maintain, and improve the reliability of the service and meet the operator's legal obligations.

Otterportal does not determine which privacy law applies, decide whether a request is valid, select a legally required response date, or make legal decisions for the customer.

5. Cookies and Similar Technology

Otterportal uses HTTP-only cookies for administrator and requester sessions, temporary MFA and requester-authentication challenges, and an optional trusted-MFA-device feature. The application configures these cookies with scoped paths where appropriate, SameSite protections and, in production, the Secure attribute. State-changing requests also use same-origin checks.

The current application does not include advertising trackers, cross-site behavioral advertising, browser fingerprinting, a general-purpose analytics tracker, or application monitoring SDK. It does not use local storage for an advertising or analytics profile. This notice must be reviewed and updated before a deployment adds analytics, advertising, monitoring, or other tracking technology.

Otterportal recognizes the Global Privacy Control signal sent as Sec-GPC: 1and treats it as a request to restrict optional sale, sharing, and cross-context targeted advertising processing where applicable. The application also treats the legacyDNT: 1 signal as a conservative fallback. These signals do not disable cookies required for authentication, security, billing, or requester-session functionality. See Your Privacy Choices for the signal received with your current request and the controls active on this site. The current application reads these headers for the request but does not persist them as an individual preference profile.

Stripe-hosted Checkout and billing-management pages may use cookies or similar technology for payment processing, authentication, fraud prevention, security, and service analytics. Stripe describes those practices in its own privacy notice.

6. When Information Is Disclosed

Information may be disclosed to:

  • authorized users of the customer identified in the request portal;
  • Stripe, the configured but currently disabled self-service payment provider, which processes billing contact details, business names, addresses, tax identifiers, payment-method information, subscription selections, invoices, payments, refunds, disputes, and related transaction information when billing is enabled, and receives the workspace identifiers and account information described above to provide checkout, billing, tax, fraud-prevention, and payment services;
  • Render, which hosts the application and managed PostgreSQL database and may process stored application data, request metadata, platform logs, and backups to provide that infrastructure;
  • Resend, which receives recipient email addresses and rendered service-email content, including relevant names, organization or request identifiers, links, and one-time codes, and returns delivery identifiers and status;
  • Have I Been Pwned, which receives only a five-character password-hash prefix and ordinary server request metadata for compromised-password screening;
  • government authorities, courts, advisers, or other parties when reasonably necessary to respond to valid legal process, protect rights or safety, or investigate suspected abuse; and
  • participants in a reviewed financing, acquisition, reorganization, or sale of all or part of the business, subject to appropriate confidentiality and legal requirements.

The operator must review this list before changing hosting, database, email, password- screening, payment, backup, analytics, or monitoring providers.

Stripe may process information on the operator's instructions and for its own purposes, such as meeting legal obligations and preventing fraud, as described in Stripe's Privacy Policy and applicable service terms.

7. Sale, Advertising, and AI Use

The current MVP does not include functionality to sell workspace or request content, use that content for cross-context behavioral advertising, or process customer content with artificial-intelligence models. Disclosing information to providers that operate the service is not an advertising use.

Before introducing a materially different use, the operator must review and update this notice and provide any notice or choice required by applicable law.

8. Retention and Deletion

Workspace administrators can configure retention periods for eligible request, audit, verification, and email-delivery records. Scheduled maintenance applies those settings only when automated retention is enabled. Request records become eligible for scheduled deletion only after they reach a closed, declined, or withdrawn status and pass the configured retention period. Expired sessions, authentication challenges, verification links, rate-limit records, and completed delivery records are cleaned up on separate schedules.

Self-service account deletion can remove an individual user or, when the user is the last member, the workspace and its active-database records. In a workspace with other users, a limited account-deletion audit record is preserved. Deletion from the active database does not establish immediate deletion from backups, infrastructure logs, caches, email providers, or downstream systems; those systems have separate lifecycles and may also be subject to legal-preservation requirements.

Otterportal keeps its Stripe customer and subscription references, current billing status, and limited webhook-processing records while needed to operate the workspace, reconcile billing, prevent duplicate processing, or meet legal obligations. Stripe separately retains payment, invoice, tax, dispute, and transaction records under its own terms, account settings, and legal obligations. Canceling a subscription or deleting a workspace therefore does not necessarily cause immediate deletion of records held by Stripe. Before accepting live payments, the operator must document and apply its financial-record retention schedule and Stripe deletion-request workflow.

Otterportal does not retain the full password or the Pwned Passwords range response after a password safety check. Render, Resend, Stripe, and Have I Been Pwned apply their own retention practices to information processed in their systems.

9. Security

Otterportal includes role-based access controls, scoped permissions and sessions, signed and expiring links, rate limiting, protected audit records, browser security headers, and application-layer encryption for selected secrets and queued email content when properly configured.

Production startup requires the operator to confirm protected database transport or private networking and data-at-rest encryption. Hosting, network, database, backup, monitoring, access review, and incident-response controls still depend on the production operator and its providers. No online service can guarantee that information will never be accessed, lost, or misused.

10. Children

Otterportal workspace accounts are a business service and are not directed to children under 13. A customer receiving a request remains responsible for determining whether and how it may handle information concerning a child or an authorized representative. If the operator learns that a child directly created a workspace account, it should investigate and take appropriate action.

11. Your Choices and Rights

For a privacy request submitted to a customer, contact that customer using the address in its portal. Depending on location and context, a person may have rights or choices concerning personal information; the customer controlling the request decides how to evaluate and respond to it.

Workspace users can use the available account-deletion control. Requests to access or correct workspace-account information, or questions about this notice, may be directed to the service operator using the contact information below. Requests may be subject to identity checks, legal exceptions, and record-preservation obligations.

An authorized workspace user can review or update available billing information through the Stripe billing-management portal. Requests concerning billing information held for Otterportal may be sent to the service operator using the contact information below. Stripe may direct requests about data it processes for Otterportal back to the operator and may handle other requests under its own privacy notice.

12. Third-Party Services

The configured production deployment uses Render for application hosting and managed PostgreSQL, Resend for service-email delivery, and Have I Been Pwned for compromised- password screening. Stripe is configured for hosted checkout and billing management but self-service billing is currently disabled. These providers process information under their service terms and privacy commitments: Render Privacy Policy, Resend Privacy Policy, Have I Been Pwned Privacy Policy, and Stripe Privacy Policy. The Stripe contracting entity and any tax-related processing depend on the production Stripe account and customer location. If a provider is replaced or supplemented, this notice must be updated before the new provider processes personal information. The current application does not provide a customer-system integration, object-storage, file-upload, advertising, or application analytics workflow.

13. Changes to This Notice

This notice may change as the product and its operating practices change. Material changes should be presented through reasonable notice before they apply prospectively. If a proposed change would materially expand how previously collected information is used, the operator must first assess any notice, choice, consent, or other legal requirement. The updated date and document version are retained with new account acceptance records.

14. Contact

For questions about an Otterportal workspace account or this Privacy Notice, the deployment operator must publish a legal contact before production use.

The deployment operator must also publish a mailing address before production use.

Privacy Notice and Data Practices | OtterPortal