1. Who We Are
OtterLabs Technologies LLC is a limited liability company organized under the laws of the State of California, United States. We provide a web-based team management application that helps small teams track members, clients, referrals, mileage, work hours, and approval workflows.
Our official business registration details appear in the footer of this page.
2. Information We Collect
2.1 Information you provide when you sign in
The Service uses third-party identity providers to authenticate you. When you sign in with Google or Microsoft, we receive the following from the provider:
- A unique user identifier (UID) assigned by the identity provider
- Your email address
- Your display name and (where provided) profile photo
- The identity provider you used (Google or Microsoft)
We do not receive or store your password from these providers.
2.2 Information you enter into the app
The Service is designed for you and your team to record day-to-day operational data. The categories of data you may choose to enter include:
- Client records: name, phone number, CIN (last 4 characters), birthday, mailing address, enrollment date, expiration date, contact history notes, and the source (e.g., Pharmacy or Health Plan) that referred them.
- Referral records: name, phone number, date received, source of referral, contact history, conversion status, and free-text notes.
- Mileage records: route date, stops (with addresses you enter), computed driving distances, payment rate, and notes.
- Member Hours records: session date, start/end times, total minutes and units, the team member's name and CIN, and whether they are a new member.
- Approvals records: approval list names, client names, and approval dates.
- Team and member data: team name, team photo, team join code, member display names, roles (Owner / Admin / Member), join dates, and per-section visibility permissions.
- Activity logs: automatic records of who added, edited, or removed items, with timestamps.
You decide what to enter. We do not require any specific data, and we do not collect data outside of what you choose to type or import into the app.
2.3 Information generated as you use the Service
- Geocoding lookups. When you enter an address into the app (for a client or a mileage stop), the address text is sent to OpenStreetMap's Nominatim service to convert it to map coordinates. Nominatim's privacy policy governs that lookup.
- Route calculations. When you click "Calculate route" in the mileage tab, the latitude and longitude of your stops are sent to the OSRM routing service (router.project-osrm.org) to compute driving distances and road geometry. No identifying information is sent with the request.
- Map tiles. The map views in the app load tile images from OpenStreetMap; your browser may share standard request data (such as IP address and viewport) with the tile server, as is normal for any map display.
2.4 Meeting Mode: calls, transcription, and shared notes
Meeting Mode lets members of a team enter a shared "room" and, optionally, start or join a video call with one another. The following applies only when you use those features.
- Presence. When you enter a room, your display name and the fact that you are in that room are visible to your teammates. If you join a call, your teammates can see that you are on it. Entering a room does not start a call, and you are never placed on a call automatically.
- Camera and microphone. A call begins with your microphone muted and your camera off. Your browser will ask for permission the first time you turn either on, and you can turn them off again at any point. We never enable your camera or microphone without you choosing to.
- Audio and video are not recorded. Live audio and video pass through our video provider to the other people on the call and are not written to storage by us. We do not record calls, and the Service has no recording or playback feature.
- Call duration. Calls end automatically after 20 minutes unless a participant extends them. We record the fact that a call was in progress in order to display it to your team; we do not log its contents.
- Transcription. If you turn on "Transcribe," your browser's built-in speech recognition converts what it hears into text. In most browsers, including Google Chrome and Microsoft Edge, this means the audio is sent to the browser vendor's speech servers for processing — not to us. The resulting text appears only on your own screen until you choose to save it as a note. Transcription is off unless you switch it on.
- Notes written during a meeting are stored like any other note and follow the same sharing rules: private to you unless you mark them public to the room or save them to a shared folder.
Because transcription relies on your browser's own speech service, and because a call carries whatever is said aloud, please keep Section 2.7 in mind: do not discuss or dictate restricted data such as Protected Health Information during a call or while transcribing.
2.5 Information stored on your device
The Service uses your browser's local storage and (via Firebase) IndexedDB to cache a copy of the data you enter so you can use the app while offline and so it loads quickly. This local data is stored on your device only and is not accessible to us beyond what synchronizes back to our cloud database when you are online.
2.6 Information we do NOT collect
For clarity, we do not collect:
- Your IP address or device fingerprint for tracking purposes
- Cross-site advertising or analytics identifiers
- Health, biometric, or sensitive personal information beyond what you choose to enter as a client record
- Payment or financial account information (the Service does not process payments)
- Children's personal information (see Section 10)
2.7 Information you must not enter into the Service
By using the Service, you agree that you will not enter, upload, or sync the following categories of data, whether in structured fields or in free-text notes:
- Protected Health Information as defined by HIPAA, including full medical record numbers, full health-plan beneficiary numbers, diagnoses, prescription details, treatment notes, or other individually identifiable health information beyond what the Service's structured fields explicitly accept (for example, a CIN truncated to its last four characters).
- Full Social Security numbers, driver's license numbers, passport numbers, or other full government-issued identification numbers.
- Full payment card numbers, bank account numbers, or other financial account credentials.
- Information of children under the age of 13 in a manner that would subject the Service to the Children's Online Privacy Protection Act ("COPPA").
- Information you do not have a clear lawful basis to enter into the Service.
This restriction is also stated in our Terms of Service, Section 8. If we reasonably believe restricted data has been introduced into the Service, we may suspend or terminate access and require prompt deletion of the data.
3. How We Use Your Information
We use the information described above solely to provide and improve the Service. Specifically:
- To authenticate you and keep you signed in across sessions and devices
- To store and sync the team data you enter, so it is available across your devices and to authorized teammates
- To enforce role-based access control (Owner, Admin, Member) and the per-section visibility permissions an Owner or Admin grants
- To display maps and compute mileage when you build a route
- To connect you to a team call when you choose to join one, and to show your teammates who is in a room or on a call
- To convert speech to text when you switch on transcription, using your browser's speech service
- To maintain activity logs visible to your teammates for accountability
- To respond to support inquiries you send us
- To detect, prevent, and address abuse, security incidents, or violations of our Terms of Service
We do not use your information for advertising. We do not sell your information. We do not train any machine learning model on your team's data.
4. Google and Microsoft Sign-In
Our use of Google user data is subject to Google's API Services User Data Policy, including the Limited Use requirements.
The Service requests only the scopes needed to sign you in. When you choose
"Sign in with Google," we request your basic profile information and email address
(openid, profile, email). We use these solely to create and identify
your account, show your name to your teammates, and contact you about the Service.
We do not request access to your Gmail, Google Drive, Google Sheets, Calendar, Contacts, or any other Google product, and the Service cannot read, create, or modify any file in your Google account.
With respect to any data obtained through Google APIs, we affirm that we:
- use it only to provide and improve the Service;
- do not transfer it to third parties except as required to operate the Service, to comply with applicable law, or as part of a merger or acquisition;
- do not use it for advertising of any kind;
- do not allow humans to read it, except (i) with your explicit consent, (ii) for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) where the data has been aggregated and anonymised.
You can review or revoke the Service's access at any time at myaccount.google.com/permissions. Revoking access will prevent you from signing in with Google; it does not delete data already stored in the Service. See Section 8 for how to request deletion.
Signing in with a Microsoft account works the same way: we receive your basic profile and email address for authentication only.
5. How We Share Information
We share information only as needed to operate the Service:
5.1 With your teammates
Data you add to a team (clients, referrals, mileage, member hours, approvals, activity logs) is shared with the other authenticated members of that team according to the role-based and per-section permissions configured by the team Owner and Admin(s). Your personal data outside of a team (entered in personal mode before joining a team) is not shared with anyone.
5.2 With service providers
- Google Cloud Platform / Firebase — hosts our authentication, database (Firestore), and supporting infrastructure. Their privacy policy is at https://policies.google.com/privacy.
- Microsoft — for users who sign in with a Microsoft account. Their privacy statement is at https://privacy.microsoft.com/privacystatement.
- OpenStreetMap Foundation — operates Nominatim (geocoding) and provides map tiles. See https://wiki.osmfoundation.org/wiki/Privacy_Policy.
- Project OSRM — operates the routing engine for mileage calculations. See https://github.com/Project-OSRM/osrm-backend.
- LiveKit, Inc. — carries the live audio and video of team calls between participants. Media passes through their servers in real time and is not recorded or stored by us. See https://livekit.io/privacy.
- Your browser vendor's speech service — for live dictation in Meeting Mode only. If you switch on dictation during a call, the audio your microphone picks up is sent by your browser to its own speech recognition service (Google for Chrome, Microsoft for Edge) and returned as text. This happens between your browser and that vendor; the audio does not pass through us. Dictation is off unless you enable it.
- Nobody, for recorded Conversations — when you record a conversation, the audio is transcribed on your own device. It is not uploaded to us, to Anthropic, or to any speech-recognition vendor. The recording is held in your browser's local storage while the session is open, transcribed there, and deleted when you leave the session, when you delete it, or when you sign out. Only the resulting text is saved to your team's records.
- Anthropic, PBC — provides the AI features. Text or a photograph is sent to Anthropic only at the moment you use one of those features, and only the specific item you are working on: the note being tidied, the sentence you spoke, the page you photographed, or — when you finish a recorded conversation — the transcript of that conversation, so it can be turned into notes. A transcript is sent once per conversation and only after it has been produced on your device; the audio itself is never sent. Photographs are read and then discarded — they are never stored by us, and location data is removed from the image before it is sent. Your client list is never sent; names are matched on your own device. Questions about your own records are answered on your device without sending those records anywhere. Anthropic does not use data submitted through their API to train their models. See https://www.anthropic.com/legal/privacy.
- Netlify, Inc. — hosts the static web files of the Service.
A note about the AI features. They are optional and only run when you press a button. As with transcription, do not put information into them that you would not put into the Service by hand — in particular, the restriction on Protected Health Information in our Terms applies to anything you dictate or photograph. Where the assistant proposes a change to your records, nothing is saved until you review it and confirm.
These providers process data on our behalf as needed to deliver the Service and are bound by their respective privacy policies and contractual obligations.
5.3 Legal disclosures
We may disclose information if required by law, a valid legal process, or to protect the rights, property, or safety of OtterLabs Technologies LLC, our users, or the public.
5.4 Business transfers
In the event of a merger, acquisition, or sale of company assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.
5.5 No sale of personal information
We do not sell or rent your personal information to third parties for monetary or other valuable consideration. We do not "share" personal information for cross-context behavioral advertising as defined under the California Privacy Rights Act (CPRA).
6. Data Retention
We retain your account and team data for as long as your team and account remain active. You can delete your data through the Service:
- Individual records (clients, referrals, mileage days, member hours entries, etc.) can be deleted from within the app at any time. Mileage routes go to a 7-day trash before being permanently deleted; everything else is removed immediately.
- Recorded audio is never on our servers. A recording lives only in the browser storage of the device that made it. It is deleted when you leave the session after it has been transcribed, when you press Delete recording, or when you sign out — whichever comes first. If you never finish a recording, it is discarded rather than kept.
- Team Owners can delete an entire team and all of its data.
- You can leave a team at any time. Records you contributed remain visible to the team after you leave (so the team's history is preserved), but you no longer have access to them.
- To request deletion of all data associated with your account, including authentication records, email eddyrivera@otterlabs.us. We will respond within 30 days.
Anonymized aggregate metrics (such as the total number of teams or sign-ins) may be retained indefinitely for operational purposes.
7. Data Security
We use industry-standard safeguards to protect your data:
- All traffic between your browser and our cloud infrastructure is encrypted in transit using TLS.
- Authentication is delegated to Google and Microsoft, both of which support multi-factor authentication on the account level.
- Stored data is protected by Firestore's server-side encryption at rest and our Firestore security rules, which enforce that only authenticated members of a team can read or write that team's data.
- Role-based access within a team further restricts who can change roles, grant section visibility, and remove members.
No method of transmission or storage on the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
8. Your Rights
8.1 California residents (CCPA / CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:
- Right to know. You can request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we have shared it.
- Right to delete. You can request that we delete personal information we have collected from you, subject to certain exceptions.
- Right to correct. You can request that we correct inaccurate personal information we maintain about you.
- Right to limit use of sensitive personal information. Where applicable.
- Right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of.
- Right to non-discrimination. We will not discriminate against you for exercising these rights.
To exercise any of these rights, email eddyrivera@otterlabs.us. We will verify your identity before fulfilling the request and respond within the timeframes required by law.
8.2 Users outside California
Depending on where you live, you may have similar rights under your local data protection laws. We will honor verified requests in accordance with applicable law.
9. Cookies and Local Storage
The Service does not set tracking cookies. It does use:
- Browser local storage to save your personal data, your active team, your theme preference, and similar settings, so the app loads instantly and works offline.
- IndexedDB (used by Firebase Firestore) to cache database content for offline use.
You can clear this local data from your browser's settings at any time. Doing so will sign you out and remove any unsynced changes.
10. Children's Privacy
The Service is intended for use by adults age 18 and older as part of their professional work. We do not knowingly collect personal information from children under 13 (in the United States) or under 16 (in jurisdictions where the higher age applies). If you believe a child has provided us with personal information, please contact us at eddyrivera@otterlabs.us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will provide a more prominent notice (for example, an in-app banner). Continued use of the Service after a change takes effect constitutes acceptance of the updated Policy.
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:
OtterLabs Technologies LLC
Email: eddyrivera@otterlabs.us