Privacy Policy

LAST UPDATED: JULY 27, 2026 · PLAIN-LANGUAGE VERSION — THE SIGNED SERVICE AGREEMENT GOVERNS FOR CLIENTS

What we collect

When you submit a form (application, contact), we collect what you type: name, business details, email, phone, and your answers. When you email us, we keep the correspondence. Our hosting provider (Netlify) processes form submissions and standard server logs (IP address, browser type, pages requested).

What we use it for

• Evaluating your application and contacting you about it (you consent to this on the form).
• Delivering the service if you become a client — including building your Brand Brain from information you provide.
• Improving the website and service. We don't sell your data, and we don't allow advertising use. We share it only with the vendors needed to run the service, listed on our Subprocessors page. We sign a data-processing agreement with each one.

Cookies & analytics

This site uses Plausible, a cookieless, privacy-respecting analytics tool that collects aggregate usage data only — no personal identifiers, no cross-site tracking, no advertising trackers. Embedded third-party tools (e.g., the call-scheduling page) have their own policies.

Client data

Client business information, media, and account access live in our operating system solely to deliver the service. Access is role-restricted; clients never see other clients' records. On cancellation you keep your accounts and approved assets; we retain records needed for legal and accounting purposes and delete the rest on request.

Your customers' data (for clients)

When you use Ochito's booking and follow-up tools, your customers' names and phone numbers are stored so you can run appointments, reminders, and reviews. For that information you are the owner (controller) and Ochito is your processor: we handle it only to run the service on your behalf, we never sell it, and we never use it to train AI models. You can export your customer list at any time, and you can erase an individual customer's name and number from your dashboard (Clients → remove) to honor their request. When you close your account, we delete your customers' personal information within 30 days, except where the law requires us to keep a record.

How we protect it

Data is encrypted in transit and at rest. Access is least-privilege and tenant-isolated (row-level security), owner sign-in uses a one-time code, and our providers hold independent SOC 2 attestations. We keep an audit log of sensitive actions.

Your rights

Ask us what we hold about you, correct it, export it, or request deletion — including rights under CCPA/CPRA and GDPR where they apply: +1 (305) 219-5798 · hello@ochitoai.com. We answer, usually same day, and within the timelines the law requires.