Privacy Policy

Last updated

This Privacy Policy explains how Otus Labs, Inc. (“Otus,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal information when you access or use our websites, mobile applications, software, APIs, and related services (collectively, the “Services”), or otherwise interact with us.

This Privacy Policy applies to personal information we process through the Services and our business operations.

U.S. financial privacy (GLBA). If and when we provide a financial product or service to U.S. consumers that is subject to the Gramm–Leach–Bliley Act (GLBA), we may provide an additional GLBA Consumer Privacy Notice describing our information-sharing practices and any applicable opt-out rights for certain sharing of “nonpublic personal information.” If there is a conflict between this Privacy Policy and a GLBA notice we provide for covered information, the GLBA notice controls.

2. Personal Information We Collect

We collect personal information from (a) you, (b) your devices, (c) your activity on the Services, and (d) third parties (such as identity verification, compliance, banking/payment, and analytics providers).

A. Information you provide

Depending on how you use the Services, you may provide:

  • Identifiers and contact information: name, email address, phone number, mailing address, date of birth, username, and similar identifiers.
  • Waitlist / onboarding information: interest areas, referral codes, responses to onboarding questionnaires, and preferences you choose to share.
  • Identity verification and compliance information (KYC/AML): government-issued ID information (including ID numbers and images), selfies/liveness checks, proof-of-address documents (if requested), and verification or screening results (e.g., sanctions screening), as well as other information you provide to complete compliance checks.
  • Financial account information: linked-account identifiers and funding/withdrawal instructions.
  • Communications: messages and content you send us (support tickets, emails, chat messages), survey responses, and feedback.

B. Information we collect automatically

When you use the Services, we may automatically collect:

  • Device and network information: device type, operating system, browser type, device identifiers, IP address, and mobile network information.
  • Usage and log information: access times, pages/screens viewed, features used, referring URLs, clickstream data, crash logs, and performance/diagnostic data.
  • Location information: approximate location derived from IP address (and precise location only if you enable it and we request it for a specific feature).
  • Cookies and similar technologies: described in Section 8.

If you use features that interact with blockchain networks or DeFi protocols (after launch or in limited testing), we may collect or generate:

  • Wallet addresses and onchain identifiers associated with your activity.
  • Transaction information: transaction hashes, timestamps, protocol interactions, asset amounts, deposits/withdrawals, and related metadata.
  • Public blockchain data: information that may be publicly available on a blockchain or through third-party explorers and analytics providers.

Important: Blockchain records may be public, permanent, and not capable of being modified or deleted by Otus.

D. Information from third parties

We may receive information about you from:

  • Identity verification, fraud, and compliance providers (verification outcomes, risk signals, watchlist/sanctions screening results).
  • Bank-linking, payment, and money movement providers (account ownership checks, transfer status, account metadata you authorize us to receive).
  • Analytics and advertising partners (device/engagement metrics; campaign attribution).
  • Other service providers that support the Services.

E. Information we will never ask you for

We will never ask you to share your wallet seed phrase, private keys, or recovery phrase.

3. How We Use Personal Information

We use personal information to:

  • Provide and operate the Services (create accounts, authenticate users, administer onboarding, and deliver features).
  • Process requests and user-directed actions (e.g., account linking and, after launch where enabled, deposits/withdrawals/transactions initiated through the Services).
  • Identity verification, compliance, and risk management (KYC/AML checks where applicable, sanctions screening, fraud prevention, security monitoring, recordkeeping and audits).
  • Customer support and communications (respond to inquiries; send service-related notices such as account, security, or product updates).
  • Personalization (remember preferences and tailor your experience).
  • Analytics and improvement (understand usage; troubleshoot; test, develop, and improve the Services).
  • Marketing (send marketing communications where permitted; measure marketing effectiveness).
  • Legal and business purposes (comply with law, enforce agreements, protect rights and safety, and support corporate transactions).

Automated processing and AI/ML systems. We use automated systems to operate the Services, including AI and machine learning models that may be developed by Otus or licensed from third-party providers. These systems support functions such as security monitoring, fraud detection, user support, and the execution of automated allocation and rebalancing strategies you authorize.

When we use third-party AI model providers, we may send certain data to those providers to process on our behalf. We take reasonable steps to limit the personal information shared with model providers to what is necessary for the relevant function. Some model providers may be located outside the United States; see Section 11 for more information on international transfers.

Where state law provides rights relating to profiling in furtherance of decisions that produce legal or similarly significant effects, you may have the right to opt out or obtain additional information. See Section 9.

De-identified and aggregated data. We may create and use de-identified or aggregated data for lawful purposes such as analytics, product improvement, and research. We take reasonable measures to maintain and use de-identified data in de-identified form.

4. How We Share Personal Information

We may share personal information in the following circumstances:

A. Service providers

We share information with vendors and service providers who process personal information on our behalf to provide services such as hosting, analytics, communications, customer support, identity verification, and fraud prevention. These providers are authorized to use personal information only as needed to provide services to us and are subject to contractual safeguards.

B. Compliance, identity verification, and fraud prevention partners

We may share information with identity verification, compliance, and fraud-prevention partners to conduct KYC/AML checks, sanctions screening, risk monitoring, and related compliance activities.

C. Banking, payments, and money movement partners

We may share information with banking/payment partners and related service providers to facilitate account linking, deposits, withdrawals, transfers, and transaction processing.

D. Onchain networks and protocols

If you direct Otus to interact with blockchain networks or DeFi protocols, information about those transactions may be recorded on public blockchains and accessible to third parties. We cannot control third parties’ use of public blockchain data.

We may disclose information if we believe it is necessary to comply with law, regulation, legal process, or lawful government requests; protect the rights, property, and safety of Otus, our users, or others; or detect, prevent, and address fraud, security, or technical issues.

F. Business transfers

We may share information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets.

We may share information when you request, direct, or consent to the sharing.

5. Targeted Advertising, “Sale,” and “Sharing”

We do not sell personal information for money.

Some U.S. privacy laws define “sale” or “sharing” broadly to include disclosing personal information for cross-context behavioral advertising (targeted advertising). If we engage in such practices, we will provide an opt-out mechanism.

6. Data Retention

We retain personal information for as long as reasonably necessary to:

  • provide the Services;
  • comply with legal, tax, accounting, and regulatory requirements (including required recordkeeping);
  • prevent fraud and enhance security;
  • resolve disputes and enforce agreements.

Retention periods vary by data type and purpose. In some cases, we may retain information longer where required or permitted by law, including after account closure. Certain information (such as public blockchain records) may be retained outside our systems by third parties and may not be deletable.

7. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information. Measures may include access controls, encryption where appropriate, monitoring, vendor risk management, incident response processes, and regular testing. No system is perfectly secure, and we cannot guarantee absolute security.

8. Cookies and Similar Technologies

We use cookies and similar technologies (such as pixels and SDKs) to operate the Services, remember preferences, understand usage, improve performance, and measure marketing effectiveness—and, where enabled, support targeted advertising.

You can also control cookies through your browser or device settings. Blocking some cookies may affect functionality.

9. Your Privacy Rights and Choices

Depending on where you live, you may have rights to:

  • Access personal information we hold about you;
  • Correct inaccurate personal information;
  • Delete certain personal information;
  • Obtain a copy of certain personal information (data portability);
  • Opt out of targeted advertising and certain profiling/automated processing (where applicable);
  • Appeal a denial of a rights request (in certain jurisdictions).

To exercise these rights, contact us at info@otus.io. We may need to verify your identity before fulfilling requests.

Marketing communications. You can opt out of promotional emails by using the unsubscribe link in those messages. You may still receive service-related messages (e.g., security alerts, administrative notices).

Profiling and automated decisionmaking. The Services use automated systems to execute allocation, rebalancing, and yield-optimization actions you authorize. These systems may make decisions — such as which protocols to route funds through, when to rebalance, or when to pause activity — that affect your account.

Depending on where you live, you may have the right to:

  • Be informed about the logic, significance, and likely consequences of these automated decisions;
  • Opt out of certain forms of profiling that produce legal or similarly significant effects;
  • Request human review of certain automated decisions;
  • Receive additional information about how the systems operate.

Because the Services are noncustodial and operate only within permissions you grant, you retain ultimate control over your wallet and can revoke agent permissions at any time. You may also choose to use the Services without automated features, subject to available configurations.

To exercise these rights or request additional information, contact us at info@otus.io.

10. U.S. State Privacy Disclosures

If you are a resident of certain U.S. states (including California), additional disclosures and rights may apply.

Categories of personal information collected: identifiers/contact information; internet/network activity; device and approximate location data; communications; compliance/KYC data; and (where applicable) blockchain and transaction metadata.

Purposes: described in Section 3.

Categories of recipients: described in Section 4 (service providers; compliance partners; banking/payment partners; onchain networks/protocols as directed; legal and business transfer recipients).

Sensitive personal information. We may collect or process certain sensitive personal information (e.g., government ID, account credentials, and KYC results) for purposes such as providing the Services, security, fraud prevention, and compliance. Where applicable law provides rights to limit certain uses, we will honor those rights.

Minors. The Services are intended for individuals age 18+. We do not knowingly sell or share personal information of individuals under 18.

GLBA and other exemptions. Certain information may be exempt from state privacy laws where covered by GLBA or other sector-specific laws.

11. Service Providers Located Outside the United States

Although the Services are offered to U.S. users, some of our service providers — including cloud infrastructure, analytics, and AI model providers — may be located outside the United States or may process data outside the United States. Where this occurs, we take reasonable steps to ensure appropriate protections are in place.

If you would like more information about the categories of service providers we use and their locations, contact us at info@otus.io.

12. Children’s Privacy

The Services are not directed to children. If you believe a child has provided personal information to us, please contact info@otus.io.

The Services may contain links to third-party websites, applications, or services (including third-party protocols). Their privacy practices are governed by their own policies, not ours.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will update the “Last Updated” date and provide additional notice where required by law.

15. Contact Us

Otus Labs, Inc.

Email: info@otus.io