Privacy at Oteo

Who is responsible

Oteo is a Dutch sole proprietorship (eenmanszaak), Chamber of Commerce (KvK) 82061386, The Hague, the Netherlands. Questions about your data go to support@getoteo.com.

Oteo is responsible for your account, your subscription, this website and the security logs. Your own company decides about the invoices, mails and bank lines in your workspace. Oteo processes those on your behalf, under the data processing agreement.

Questions about your data go through the contact page.

What Oteo keeps

• Your account: name, e-mail address and language.
• Your business: company name, country, VAT number, and the customers and products you invoice.
• Invoices, receipts and bank lines you add, with the files themselves.
• From Gmail or Outlook, if you connect it: only messages with invoices and receipts. Oteo never sends or deletes e-mail; it only labels or moves invoice mails if you turn on filing.
• From Google Drive, if you connect it: only the files you pick in Google's own window. Oteo never sees or changes the rest of your Drive.
• From Outlook and OneDrive, if you connect them: mail with invoices and receipts, and the files in Oteo's own OneDrive folder (Apps/Oteo). Oteo never sends or deletes mail and never sees the rest of your OneDrive.
• From Telegram, if you link it: your chat ID, your Telegram name and the files you send to the Oteo bot. Oteo only answers your own messages.
• Your answers when Oteo asks how you like it. Oteo only quotes you, with your first name, if you tick that separately, and you can withdraw it at any time.
• If you set up Oteo through an invitation link and keep the code, which workspace invited yours. The person who invited you only sees a number, not who you are.
• Your plan and payment status. Your card details stay with Stripe; Oteo never sees them.
• Messages to Oteo support and your questions to Oteo AI.
• A log of every look by Oteo staff, with the reason.

Your mailbox and other connections

• Only what is needed. Oteo searches your mailbox for invoices and receipts. Mail that does not look like one is not kept. Oteo only keeps a technical marker, so the same mail is not processed twice.
• Reading, not writing. Oteo never sends or deletes mail. If you switch on the rule to label or move processed mail yourself, Oteo asks for that permission separately and does only that.
• Permissions at Google. Gmail: read only (gmail.readonly), plus gmail.modify only if you switch on the label rule. Google Drive: only files you choose yourself or that Oteo creates (drive.file).
• No person reads along. Searching and reading happen automatically. An Oteo staff member only looks if you ask for help, for security, or when the law requires it. Every look is logged.
• Disconnecting. If you disconnect a mailbox or service, Oteo stops collecting at once and deletes the keys. Invoices already in stay in your workspace. You can also revoke access at Google or Microsoft yourself.
• No training. Oteo does not use your data, including data from Google or Microsoft, to develop or train general AI models.

Is your name or IBAN on an invoice that an Oteo customer uploaded? Then that company decides what happens with it. Contact that company first. If that does not work, we help you further.

Why, and on what basis

Who helps us

They only process data for Oteo and may not use it for themselves.

Data outside the EU

The database is in Ireland and the servers are in Dublin (Ireland). To read a document, Oteo sends its content to Anthropic (Claude, United States) or Google (Gemini); the other one reads it a second time when in doubt. OpenAI (United States) is the last reserve and answers questions to Oteo AI. If you send a document through WhatsApp, it comes in through Kapso and Meta's WhatsApp service. Other helpers are American companies too. Transfers only happen under the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission. These AI services do not use the data to train models. If you turn on Marketing on the website, Google (United States) receives your visit data, under the EU-US Data Privacy Framework.

How long we keep it

You have to keep your own records for 7 years. So export your documents before you cancel.

Google data

If you connect Gmail or Google Drive, Oteo uses the data from Google only to collect and show your invoices and receipts. Oteo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Oteo does not use Google data for advertising, does not sell it, and does not let AI models train on it. People at Oteo only read it with your permission, for security, or when the law requires it.

Security

Every workspace is shielded per customer in the database. Connections and stored data are encrypted. An Oteo staff member only looks inside at your request, and every look is logged. If a data breach affects you, we let you know.

Your rights

You can ask Oteo to see, correct, delete or transfer your data, or to limit its use. You can also object. You can always withdraw consent. We answer within one month. If it concerns the content of a workspace, we pass your request on to the company of that workspace.

If you disagree with how we handle your data, you can complain to the Autoriteit Persoonsgegevens. If you live in Spain, to the AEPD.

What Oteo never does

• Sell your data or use it for advertising.
• Make payments or file returns for you.
• Send e-mail from your mailbox.

Changes

If something important changes in this statement, we let you know by mail or in the app.

Age

Oteo is for business owners aged 18 and over. We do not knowingly collect data from younger people. If it turns out we did, we delete it.

Versions