Legal

Privacy Policy

This page is a placeholder. The full policy is being finalised with our legal and compliance team ahead of school pilots, and will be sent to every participating school before a child opens the app.

What we hold

otta is built around data minimisation. A child profile holds what a session needs; identifying details stay out of the conversation record. Session data is encrypted in transit and at rest.

Who can see it

Access is scoped to the school or family account that owns the record. School dashboards show aggregated trends only, never an individual child's words or scores.

Deletion

A deletion request reaches derived records, backups, and downstream logs, and leaves an audit trail. Parents and schools can make the request through their account.

Standards

The platform is built and audited against Classified Protection of Cybersecurity Level 3 (MLPS 2.0) requirements, with medical-grade data governance and zero-retention protocols for external language models.

Questions

Write to contact@otta.cc. We will share the full policy and the data-processing terms before any pilot begins.