Privacy Policy

1. Who We Are

Otnox is a procurement analytics platform operated by SIA «Vietne», a company registered in the Republic of Latvia (registration number: 40103048838), with its registered office at Ozolciema iela 46 k-5 - 35, Rīga, LV-1058, Latvia (hereinafter “we”, “us”, or “the Company”).

We act as the data controller for the personal data processed through the Otnox platform at otnox.com. If you have any questions about how we handle your data, please contact us at [email protected].

2. Data We Collect

We collect and process the following categories of personal data:

• Account information — name, email address, company name, and role when you create an account or are invited to a workspace.
• Authentication data — hashed passwords and session tokens managed through our authentication provider (Supabase Auth).
• Usage data — pages visited, features used, saved filters, monitor configurations, and pipeline stages to provide and improve the service.
• Billing data — payment method details, subscription tier, and invoicing information processed by Stripe. We do not store full card numbers on our servers.
• Device and log data — IP address, browser type, operating system, and timestamps collected automatically for security and analytics purposes.

3. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — to provide the Otnox platform, manage your account, and fulfill our subscription obligations.
• Legitimate interests (Art. 6(1)(f) GDPR) — to improve our services, prevent fraud, ensure platform security, and conduct analytics on aggregated usage patterns.
• Consent (Art. 6(1)(a) GDPR) — for optional cookies (performance, functional, and marketing) and marketing communications. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c) GDPR) — to comply with applicable tax, accounting, and regulatory requirements.

4. How We Use Your Data

We use personal data to:

• Create and maintain your account and workspace.
• Provide procurement analytics, tender monitoring, and notification services.
• Process subscription payments and manage billing.
• Send transactional emails (e.g., account verification, password resets, monitor alerts).
• Improve platform performance, fix bugs, and develop new features.
• Comply with legal obligations and respond to lawful requests from authorities.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. Specifically:

• Account data is retained until you delete your account. Upon deletion, personal data is removed within 30 days, except where retention is required by law.
• Billing records are retained for 7 years to comply with Latvian tax and accounting regulations.
• Log and usage data is retained for up to 12 months for security and analytics purposes, then anonymized or deleted.

6. Third-Party Services

We share personal data with the following third-party processors, each bound by data processing agreements:

• Google Cloud Platform (GCP) — cloud infrastructure hosting, data storage, and compute services. Data is stored in EU data centers (europe-west region).
• Stripe — payment processing and subscription management. Stripe acts as an independent data controller for payment data. See Stripe’s Privacy Policy.
• Supabase — authentication services and database hosting (EU region).
• Google Analytics (GA4) — anonymous, aggregated website usage analytics to help us understand how visitors interact with the platform. See Google’s Privacy Policy.
• Mailgun — transactional and notification email delivery. Data transferred to the US under Standard Contractual Clauses (SCC). See Mailgun’s Privacy Policy.
• OpenAI — AI processing for optional intelligence features (tender summaries, competition verdicts, opportunity qualification). Only tender content and, where you use qualification features, your company profile description are sent for processing; they are not used to train OpenAI’s models under our API terms. See OpenAI’s Privacy Policy.

We do not sell your personal data to third parties. We do not transfer personal data outside the European Economic Area (EEA) unless adequate safeguards are in place (e.g., Standard Contractual Clauses).

6a. AI Assistant Integrations (Claude, ChatGPT)

You can connect your Otnox account to AI assistants such as Anthropic Claude or OpenAI ChatGPT through our connector (MCP server). This connection is optional and only established when you explicitly authorize it on our consent screen.

• What the assistant can access: read-only procurement data available to your plan (tender search and details, buyer profiles, competition statistics) and, when you request an opportunity qualification, your company profile. It cannot modify your data, manage billing, or access buyer contact details.
• What we receive: only the tool requests the assistant makes on your behalf (e.g. search filters, a tender reference). We do not see or store your conversation with the assistant.
• What we log: the tool name, your account identifier, timestamps and result counts — for security, rate limiting and billing. Never conversation content.
• Data you receive in the assistant: once returned to Claude or ChatGPT, the data becomes part of your conversation and is handled under that provider’s own privacy policy and settings.
• Revoking access: you can disconnect the integration at any time from the assistant’s settings or by contacting us; access tokens are revocable and expire automatically.

7. Your Rights

Under the GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data (“right to be forgotten”).
• Restriction — request that we limit processing of your data.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

8. Supervisory Authority

If you believe we have not handled your data in accordance with applicable law, you have the right to lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija, DVI):

• Website: www.dvi.gov.lv
• Email: [email protected]

9. Cookies

We use cookies and similar technologies to operate the platform and improve your experience. For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notification at least 14 days before the changes take effect. Continued use of Otnox after the effective date constitutes acceptance of the updated policy.