我们的法律文件仅以英文发布。英文版为权威文本；网站其余部分提供法语和简体中文版本。
Privacy Policy
18317208 Canada Corp., operating as OtterSR, a federal corporation incorporated under the Canada Business Corporations Act, with its registered office at 83 Gruhn St, Kitchener, ON N2G 1S5, is the controller for the personal data described here.
Last updated · Version 2026-11-05.3
1.The short version
- We collect the least we can: who you are, what you do in the application, and what it costs to run your AI requests.
- Your research content — references, PDFs, protocols, decisions — is yours. We process it only to run the service for you.
- We do not use your content to train models, and we do not sell anything.
- There is no analytics, no advertising and no third-party tracking. Four cookies exist and all four are strictly necessary.
- You can take everything with you, and you can have it destroyed.
2.What we collect, and why
Account and identity
| Data | Why | Basis |
|---|---|---|
| Email address | To identify your account and send service messages | Contract |
| Name | To address you, and to show colleagues who decided what | Contract |
| Password | To sign you in. Amazon Cognito keeps it as a salted hash, which we cannot read | Contract |
| Organisation, role, research field, typical review size, how you heard of us | Optional. To understand who the product is for | Consent |
| Country | Tax, where charging applies | Legal obligation |
| Language preference | To show the interface in your language | Contract |
| Terms and privacy version accepted, and when | To show what you agreed to | Legal obligation |
| Marketing consent | Only if you opt in; unticked by default | Consent |
Your email address reaches us when you create an account, or when somebody on our side enters it to set one up for you. We use it to send you service email through Amazon SES (section 3): invitations and notices that a job has finished.
Since 5 November 2026, signing in with an email address and a password runs on Amazon Cognito (section 3). Cognito holds your email address, name and password, and records sign-in events. It emails you a code to confirm your address when you sign up yourself, and a code to reset your password if you ask for one. For now both codes come from AWS's sender, no-reply@verificationemail.com, not from an ottersr.com address. We keep our own account record and our own sign-in sessions (see Technical below).
Before 5 November 2026 we kept a hash of your password (Argon2) in our own database. It is deleted when your password moves to Cognito, at your next sign-in. If your old password does not meet Cognito's rules, it moves, and the hash is deleted, only when you reset or change it. Until then the hash stays in our database.
If you save a card, Stripe holds it. We keep its brand, last four digits, expiry, whether it is credit, debit or prepaid, and Stripe's opaque fingerprint of the card number. We keep the fingerprint after a card is removed or an account is closed, because it is how we hold the first-review credit to one per card.
Research content
References, abstracts, uploaded PDFs, protocols, AI answers, your decisions, extracted data, exports and saved searches.
This is normally bibliographic data about *published work*, not personal data about individuals. It may contain the names of authors, which are personal data about them; the lawful basis for that is our legitimate interest in providing a research tool, and the source is you.
Personal health information must not be uploaded. The Terms forbid it. There is no filter that enforces it, so please do not.
Usage and billing
Every AI request is recorded: which model, how many tokens, what it cost, which review and which citation it belonged to, and who asked for it. This is how you see your spending and how we bill correctly.
Technical
Sign-in sessions record the browser's user agent, IP address and times, so you can see where your account is signed in and sign out a device you do not recognise. Amazon Cognito records sign-in events of its own. Server logs record requests and errors.
3.Who else sees it
| Processor | What they handle | Where |
|---|---|---|
| OpenAI — API | The prompts we build from your content, and the answers; and passages of your documents, turned into search vectors (embeddings) for the search index | United States — see section 4 |
| Amazon Web Services — EC2, EBS and S3 | The application, its database and logs; uploaded files | us-east-2 (United States, Ohio) |
| Amazon Web Services — Amplify Hosting | Serves the web app; your requests pass through it to the application, and it keeps no review content | us-east-2 (United States, Ohio), entering through the nearest AWS edge location |
| Amazon Web Services — Cognito | Signs you in with an email address and password. It holds your email address, name and password (as a salted hash we cannot read), records sign-in events, and emails sign-up confirmation and password-reset codes, for now from no-reply@verificationemail.com | us-east-2 (United States, Ohio) |
| Amazon Web Services — SES | Sends our service email: invitations and notices that a job has finished. It receives your email address, your name where the email uses it, and the message | us-east-2 (United States, Ohio) |
| Microsoft 365 | Email you send to support@ottersr.com | Microsoft's data centres for our tenant |
| Stripe | Your name and email, the card you enter (it goes directly to Stripe and never reaches us), and each payment's amount and description, which names the review | United States and Canada |
That is the whole list. There is no analytics provider, no advertising network, no session-replay tool and no third-party font service.
4.Where your content is processed — read this one
From 5 November 2026, our application, database and file storage are in the United States, in AWS us-east-2 (Ohio). Before that date they were in Canada.
Model inference is in the United States too. Every engine tier (Otter-Nano, Otter-Mini, Otter-Pro and Otter-Max) runs on OpenAI's API, which processes requests in the United States. The search index, the embeddings of passages from your documents, is computed by OpenAI too.
So when you use any AI feature (screening, extraction or writing), the prompt is processed in the United States. It contains the title, abstract and any extra fields of the citation, the text of an uploaded PDF, or the passages and extracted values a writing command uses. Extraction and writing also send passages of your documents to OpenAI to build the search index. If that matters to your ethics approval or your institution's policy, do not use AI features for that review. Not using them keeps that text away from OpenAI; it is stored in the United States either way.
The models moved from Amazon Bedrock to OpenAI on 25 September 2026, and the search embeddings followed on 5 November 2026. We no longer use Amazon Bedrock.
What OpenAI does with it
Every model request is sent with storage turned off, so OpenAI keeps no copy of the answer for us to fetch later. Under OpenAI's API terms, content sent to the API, including the passages sent for the search index, is not used to train its models, and may be kept for a limited time (currently up to 30 days) to detect abuse. That is OpenAI's commitment to us, which we pass on to you; it is not something our software can enforce, and we describe it here as what it is.
6.How long we keep it
| What | Kept for |
|---|---|
| A review you delete | 30 days, then destroyed, including its PDFs |
| A closed account's content | 60 days after you ask, then destroyed |
| Your sign-in record at Amazon Cognito (email address, name, password) | As long as your user record. Closing an account destroys its content, not the record of who you are; write to us and we delete both |
| Sign-in sessions | 14 days idle, 30 days absolute |
| Invoices, usage records, audit log | As long as the law requires. They contain no research content |
| Database backups | 14 days |
| Superseded file versions | 30 days |
These are not aspirations. A job runs daily and deletes what is due; if it did not, "deleted after 30 days" would be a sentence in a policy and nothing more.
7.Your rights
Depending on where you live you may have the right to access, correct, delete, restrict or object to our handling of your personal data, to withdraw consent, and to receive your data in a portable form.
Two of these do not require you to ask us:
- Portability — a complete machine-readable export of your account is available in the application at any time.
- Erasure — you can close your account yourself, and the content is destroyed after the grace period.
For anything else, write to 83 Gruhn St, Kitchener, ON N2G 1S5. We will reply within one month under GDPR.
If you are unhappy with our answer you may complain to your supervisory authority: in Canada the Office of the Privacy Commissioner, in the EU your national authority, in the UK the Information Commissioner's Office.
8.Security
- Every tenant table is protected by database row-level security, enforced under an application role that cannot bypass it. A query that forgets to scope itself returns nothing rather than someone else's data.
- Files are stored per account, with server-generated names, and are never shared between accounts.
- Data is encrypted in transit and at rest.
- Sessions are server-side and opaque; there is no token in your browser's storage and none in any URL.
No system is perfectly secure. If you find a problem, please tell us at 83 Gruhn St, Kitchener, ON N2G 1S5 before telling anyone else.
9.Children
OtterSR is a professional research tool and is not directed at children. We do not knowingly collect data from anyone under 18.
10.Changes
We will post any change here and update the version at the top. If a change materially affects you we will say so in the application or by email before it takes effect. The version you accepted is recorded against your account.