Privacy

Ottobrowse is a CRM. It keeps your sales records and reads your connected inbox for threads with your contacts. On the paid plan (Pro, and its trial) an AI agent also researches companies on the public web and drafts messages for you to send; the free plan uses no AI. This page explains what we collect to do that, who processes it, and how to take it back.

Your account

• Identity: your email address, and — if you sign in with Google — the name and profile image Google returns. Nothing more; signing in never grants access to your mail.
• Billing: our payment processor handles your card details. We do not store your full card number. We keep customer and subscription references, your plan, and usage against your plan allowances.
• Operational records: request ids, timestamps and error codes, kept so we can answer “what happened to this job”.

The CRM: what we collect

• What you give us: accounts, contacts, deals, notes, logged calls and meetings, next steps, email templates, sequences, emails you write, a description of who you sell to, and anything you import from a CSV.
• What the agent finds: facts about companies and the people who work there, each saved with the public page it came from. Email addresses are kept only where a page we read publishes them.
• What the agent writes: call briefs and drafted messages, which wait for you. A record of each agent job — its steps and the pages it read — is kept with your account.
• If you connect Gmail: we read threads with people already in your CRM when you open the inbox, and send the messages you write or approve from your own address. Once an hour we also check the sender, subject and date (not the text) of recent messages from those people, so a reply is logged on its deal and stops its sequence. Your mailbox is not copied into Ottobrowse; drafts, the fact that a message was sent or received, and its subject are kept on the deal.
• If you ask the agent to draft a reply (Pro): the text of that thread’s recent messages is sent to a model provider to write the draft. Nothing from your mailbox goes to a model otherwise, and nothing at all on the free plan.

You decide who goes into your CRM, so you are the controller of the personal data about your contacts, and you need your own lawful basis for holding it and for writing to them. We process it for you, to provide the service.

How the agent researches

To research an account, the agent reads the company’s public pages, in a browser of its own running in an isolated cloud machine or with a plain request, honouring robots.txt (see OttobrowseBot); it also runs a web search. It does not sign in anywhere, click, type or submit. We do not record the screen. The text it reads is sent to a model provider to be turned into facts with sources, and the browser and everything in it are destroyed when the job ends.

Service providers

We use independent service providers to operate the platform. The names below identify who processes data; they do not imply sponsorship, endorsement, or a partnership.

• Supabase (US) — accounts and CRM records, and job-search data for the accounts that have it.
• Vercel (US) — hosting, and the Sandbox microVMs the agent’s browser runs in.
• Stripe — payments, and the card details we never receive.
• Resend — transactional email such as sign-in and password links.
• Vercel AI Gateway — routes every model request Ottobrowse makes. We request zero data retention where the provider supports it. Sessions run through the legacy standalone browser API involve no model calls.
• Model providers reached through that gateway — currently Google,Anthropic, OpenAI and Perplexity. They draft messages and call briefs, turn the pages the agent reads into sourced facts, find companies that fit your ideal customer, and run web research; for the job search they also extract facts from résumés and postings and assist the application browser. We choose a model per task and may change which provider serves one; this list is the set we use today.

What we never do

• We never sell your data, and we do not train models on it.
• We never ask for, store, or show a model your passwords for other sites.
• The agent never sends an email, books a meeting or submits a form. It drafts; only you send.

How long we keep it

Account and CRM data stay until you delete them. Session records are kept while they are needed to bill and support you, and our payment processor keeps billing history for as long as tax and accounting rules require. For job-search accounts, remembered logins, where you opt into them, are encrypted at rest and expire after 30 days.

Your rights

You can download everything we hold about you and delete your account at any time from Plan in the CRM. Deletion removes your data from our systems and stops any running agent jobs; it cannot unsend messages you already sent or withdraw job applications already submitted, and it does not erase invoices we are required to keep. Residents of Canada (PIPEDA), California (CCPA/CPRA) and the EEA/UK (GDPR) have these rights by law; we extend them to everyone.

Mailbox access

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Mailbox access is limited to threads with your CRM contacts (and, for job-search accounts, recruiting correspondence), is used only to provide features you can see in the app, and can be revoked with Disconnect Gmail on the CRM’s Inbox or from your Google account.

AI disclosure

Briefs and messages Ottobrowse drafts are generated by AI from your records and the sources it cites. Every draft is shown to you before it is used, and you can edit anything.

Getting in touch

Privacy questions, access requests and complaints: privacy@ottobrowse.com.

Retired: the job search

Ottobrowse’s job search was retired on 8 October 2026 and nothing runs in it any more: no searches, applications, mailbox sync or model calls. What it collected for the accounts that used it is kept until you delete it, can be downloaded with everything else from Plan in the CRM, and is deleted with your account. It consisted of:

• What you give us: your résumé, the facts you confirm, answers to application questions, and anything you type.
• What we generate: cover notes, answers and email drafts, each with a record of which of your facts supports each claim.
• If you connect a mailbox: recruiting threads only — subject, sender and a short snippet. We fetch full message text when you open a thread and do not store it.
• Public research: names and titles of people at employers you apply to, from public sources we cite, and email addresses only where they are published on a page we checked.
• Search schedules: your job criteria, selected profile version, consent, application decisions, and submission evidence.
• Audit trail: every action taken by you or the agent, and the cost of each step.

For the job search’s application research and résumé tailoring, we send the selected résumé, confirmed career facts, and job posting to the model providers listed above, through Vercel AI Gateway. Which provider handles a given step depends on the task — drafting, extraction, claim checking, browser assistance and research are configured separately and can change. Research results are saved with your application. We request deletion of completed or stopped research sessions during scheduled cleanup; account deletion also removes those sessions. Model processing is subject to the provider’s retention policies.

• We never sell your data, and we do not train models on it.
• We never ask for, store, or show a model your passwords for other sites.
• Ottobrowse Jobs never records or replays the contents of its browser sessions.
• Ottobrowse submits applications only with your explicit automatic-application authorization, or you submit them yourself. It never sends an email you have not approved word for word.
• Ottobrowse never answers questions about work authorization, sponsorship, salary, EEO status, criminal history, export control or clearance on your behalf. EEO self-identification defaults to declining.

When the job search fills an employer’s form, the details you authorized go to that employer’s hiring system — we show you exactly which ones before we start.

Sensitive information

Some application questions involve sensitive information — race, disability, veteran status, immigration status. We store answers to these only if you give them, use them only to answer that same kind of question in the scope you set, and you can remove them at any time. Under California law you may limit the use of sensitive personal information; we already use it only to provide the service you asked for.

Existing browser API projects

The standalone browser API is no longer sold. For projects that still have one:

• API keys: we never store your API keys themselves, only a one-way fingerprint of each (a SHA-256 hash) that lets us recognise a key without being able to reproduce it. We also keep the last four characters, so you can tell your keys apart, and when each was last used.

Unless you ask us to, we do not look inside your browser sessions. By default we do not record the screen, log the pages you visit, intercept traffic, or keep a copy of what loads. What the browser fetches is between your code and the sites you point it at.

What you can ask us to keep, per session or for your whole project:

• Recordings — a replay of each page (its structure and changes, recorded with rrweb). Password fields are masked. Deleted after 7 days on the API’s free plan and 30 days on its paid plans, or with your account.
• Logs — console messages, and the URL, status and timing of each request. Never request or response bodies or headers. Same retention as recordings.
• Contexts — a browser's cookies and storage, saved so a later session starts signed in. Encrypted with a key of its own before it leaves the browser; saved passwords are never kept. Kept until you delete the context or your account.
• Proxies — the address of a proxy you give us, and the bytes that pass through it. Its password is held only in memory while the session runs, and never stored or returned.

What we do keep is the shape of the session, not its content: when it started and ended, how long it ran, its timeout, its status, and which project it belonged to — the records that produce your bill and let us investigate a failure.

Each session runs on a machine of its own — an isolated environment that keeps its browser separate from other sessions. Nothing is saved when it stops: the whole machine, including the browser profile, cookies, cache and anything written to disk, is destroyed. From inside, it cannot reach private networks or the internal addresses servers use to identify themselves to their cloud, and only encrypted (HTTPS) traffic may leave. The links used to connect to a browser or watch it are signed with a key belonging to that session alone, and are never written to our logs.

Because we cannot see what you process, you are the controller of any personal data your browsers touch, and you need your own lawful basis for collecting it. We are your processor for the session records above, and for the recordings, logs and contexts you ask us to keep.