Privacy Policy

Courtesy translation — in case of discrepancy, the French version prevails.

Data we collect

To provide the service, we collect:

• Your Google email (via Sign in with Google) and your name.
• Your Google Business Profile refresh tokens, encrypted (Fernet, AES-128) before storage in our database.
• Your Google reviews and the generated replies.
• If you connect Facebook or Instagram (see below): the list of your Pages, the comments posted under your publications, the direct messages received by your Page or professional Instagram account, the recent posts of those accounts, and the replies generated or sent.
• Payment information, handled by Stripe.

Facebook and Instagram (Meta platforms)

Ottonomo uses the Meta API (Facebook Login, Pages, Instagram Graph API, Messenger Platform) only when you connect your Facebook Page or professional Instagram account yourself, through Meta's official authorization dialog. We never see your password.

We use this access to, and only to:

• list your Pages so you can choose which one to connect;
• read the comments under your posts and suggest a reply, published only after your approval;
• receive the direct messages sent to your Page or Instagram account, send the reply you approved, or an automatic reply limited to the information you entered yourself in your knowledge base (hours, address, booking);
• read your recent posts to offer reusing them on your Google listing, at your request.

Meta access tokens are encrypted (AES-128) before storage. Meta data is never sold, never shared with third parties for advertising, and never used to train artificial-intelligence models. The text of comments and messages is sent to the Anthropic Claude API to draft replies (see below). We keep this data while your account is active; you can revoke access at any time from Facebook (Settings, Apps and websites, Ottonomo, Remove) and request full deletion: see the Data deletion page.

Use of Claude (Anthropic)

The content of your reviews is sent to the Anthropic Claude API to generate replies and extract themes. Anthropic does not retain this data and does not use it to train its models.

Hosting and processors

Database and files: Supabase, Montréal region (aws-ca-central-1). Worker: Railway. Frontend: Vercel. Transactional email (notifications, email approval): Resend. Payments: Stripe. Text generation: Anthropic. These providers process data solely on our behalf.

Data controller

Ottonomo is operated by Groupe Umami inc., a corporation incorporated in Québec (Québec business number 1177348498), with its head office at 750 boul. Queen, Saint-Lambert, Québec J4R 1J8, Canada. Privacy officer: Jean-Paul Belmont, reachable at info@ottonomo.io.

Your rights

You can export or delete all your data at any time by writing to info@ottonomo.io. Deletion triggers revocation of Google, Facebook and Instagram access and permanent erasure within 30 days. Step-by-step instructions are on the Data deletion page.

10. Commercial email outreach (CASL)

Ottonomo may contact business owners by email when their professional address is conspicuously published on their website or on Google Maps, for outreach related to their professional role (managing their Google Business listing). This practice relies on the implied consent provided by section 10(9)(b) of Canada's Anti-Spam Legislation(CASL) — “conspicuous publication” of an address with no statement that commercial messages are unwanted, where the message is relevant to the recipient's business role.

Every email we send includes:

• Clear identification of the sender (name, legal entity, mailing address)
• An explicit statement of the basis for sending (conspicuous publication)
• A one-click unsubscribe mechanism (direct link + RFC 8058-compliant List-Unsubscribe header for Gmail/Outlook)

Unsubscribe requests are honored immediately and the address is added to our permanent suppression list. The public source of each address (the URL where the email was found) is retained so we can demonstrate the basis for implied consent upon request.

To opt out of all communication or request deletion of your data, write to jp@ottonomo.io.

Current as of November 05, 2026. PIPEDA, Québec Law 25 and CASL compliance. For any legal question, write to jp@ottonomo.io.