Privacy Policy

1. Who We Are

OtterLabs Technologies LLC is a limited liability company organized under the laws of the State of California, United States. We provide a web-based team management application that helps small teams track members, clients, referrals, mileage, work hours, and approval workflows.

Our official business registration details appear in the footer of this page.

2. Information We Collect

2.1 Information you provide when you sign in

The Service uses third-party identity providers to authenticate you. When you sign in with Google or Microsoft, we receive the following from the provider:

• A unique user identifier (UID) assigned by the identity provider
• Your email address
• Your display name and (where provided) profile photo
• The identity provider you used (Google or Microsoft)

We do not receive or store your password from these providers.

2.2 Information you enter into the app

The Service is designed for you and your team to record day-to-day operational data. The categories of data you may choose to enter include:

• Client records: name, phone number, CIN (last 4 characters), birthday, mailing address, enrollment date, expiration date, contact history notes, and the source (e.g., Pharmacy or Health Plan) that referred them.
• Referral records: name, phone number, date received, source of referral, contact history, conversion status, and free-text notes.
• Mileage records: route date, stops (with addresses you enter), computed driving distances, payment rate, and notes.
• Member Hours records: session date, start/end times, total minutes and units, the team member's name and CIN, and whether they are a new member.
• Approvals records: approval list names, client names, and approval dates.
• Team and member data: team name, team photo, team join code, member display names, roles (Owner / Admin / Member), join dates, and per-section visibility permissions.
• Activity logs: automatic records of who added, edited, or removed items, with timestamps.

You decide what to enter. We do not require any specific data, and we do not collect data outside of what you choose to type or import into the app.

2.3 Information generated as you use the Service

• Geocoding lookups. When you enter an address into the app (for a client or a mileage stop), the address text is sent to OpenStreetMap's Nominatim service to convert it to map coordinates. Nominatim's privacy policy governs that lookup.
• Route calculations. When you click "Calculate route" in the mileage tab, the latitude and longitude of your stops are sent to the OSRM routing service (router.project-osrm.org) to compute driving distances and road geometry. No identifying information is sent with the request.
• Map tiles. The map views in the app load tile images from OpenStreetMap; your browser may share standard request data (such as IP address and viewport) with the tile server, as is normal for any map display.

2.4 Information stored on your device

The Service uses your browser's local storage and (via Firebase) IndexedDB to cache a copy of the data you enter so you can use the app while offline and so it loads quickly. This local data is stored on your device only and is not accessible to us beyond what synchronizes back to our cloud database when you are online.

2.5 Information we do NOT collect

For clarity, we do not collect:

• Your IP address or device fingerprint for tracking purposes
• Cross-site advertising or analytics identifiers
• Health, biometric, or sensitive personal information beyond what you choose to enter as a client record
• Payment or financial account information (the Service does not process payments)
• Children's personal information (see Section 10)

2.6 Information you must not enter into the Service

By using the Service, you agree that you will not enter, upload, or sync the following categories of data, whether in structured fields or in free-text notes:

• Protected Health Information as defined by HIPAA, including full medical record numbers, full health-plan beneficiary numbers, diagnoses, prescription details, treatment notes, or other individually identifiable health information beyond what the Service's structured fields explicitly accept (for example, a CIN truncated to its last four characters).
• Full Social Security numbers, driver's license numbers, passport numbers, or other full government-issued identification numbers.
• Full payment card numbers, bank account numbers, or other financial account credentials.
• Information of children under the age of 13 in a manner that would subject the Service to the Children's Online Privacy Protection Act ("COPPA").
• Information you do not have a clear lawful basis to enter into the Service.

This restriction is also stated in our Terms of Service, Section 8. If we reasonably believe restricted data has been introduced into the Service, we may suspend or terminate access and require prompt deletion of the data.

3. How We Use Your Information

We use the information described above solely to provide and improve the Service. Specifically:

• To authenticate you and keep you signed in across sessions and devices
• To store and sync the team data you enter, so it is available across your devices and to authorized teammates
• To enforce role-based access control (Owner, Admin, Member) and the per-section visibility permissions an Owner or Admin grants
• To display maps and compute mileage when you build a route
• To send team data to a Google Sheet you designate when you, as the team Owner, explicitly enable the Google Sheets sync feature (see Section 4)
• To maintain activity logs visible to your teammates for accountability
• To respond to support inquiries you send us
• To detect, prevent, and address abuse, security incidents, or violations of our Terms of Service

We do not use your information for advertising. We do not sell your information. We do not train any machine learning model on your team's data.

4. Google API Services — Limited Use Disclosure

When you, as the team Owner, configure the Google Sheets sync and authorize the Service to access your Google Sheets, the following applies:

• We use the Sheets scope solely to: (a) read the metadata of the spreadsheet you provide in order to detect which tabs already exist, (b) create missing tabs ("Clients," "Referrals," "Mileage," "Member Hours," "Approvals," "People," "Activity"), and (c) write your team's data into those tabs.
• We do not read, browse, list, or access any other Google Sheets file in your Google account.
• We do not read the existing contents of cells in the destination sheet, except in the technical sense that the API call to clear a tab before rewriting it identifies the existing range.
• We do not transfer the data we receive from the Google Sheets API to any third party for purposes beyond providing or improving the Service.
• We do not use the data we receive from the Google Sheets API to serve advertisements.
• We do not allow humans to read the data we receive from the Google Sheets API, except: (i) with your explicit consent, (ii) for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) where the data has been aggregated and anonymized.
• Your OAuth access token is held in the memory of your active browser session only. It is not stored in our database, transmitted to our servers, or shared with any other party. The token automatically expires after approximately one hour, after which you must re-authorize the Service to resume Sheets sync.

You may revoke our access to your Google account at any time by visiting https://myaccount.google.com/permissions and removing OtterLabs Technologies. Revoking access will not delete the data already written to your spreadsheet; it will only stop future automatic syncs.

5. How We Share Information

We share information only as needed to operate the Service:

5.1 With your teammates

Data you add to a team (clients, referrals, mileage, member hours, approvals, activity logs) is shared with the other authenticated members of that team according to the role-based and per-section permissions configured by the team Owner and Admin(s). Your personal data outside of a team (entered in personal mode before joining a team) is not shared with anyone.

5.2 With service providers

• Google Cloud Platform / Firebase — hosts our authentication, database (Firestore), and supporting infrastructure. Their privacy policy is at https://policies.google.com/privacy.
• Microsoft — for users who sign in with a Microsoft account. Their privacy statement is at https://privacy.microsoft.com/privacystatement.
• OpenStreetMap Foundation — operates Nominatim (geocoding) and provides map tiles. See https://wiki.osmfoundation.org/wiki/Privacy_Policy.
• Project OSRM — operates the routing engine for mileage calculations. See https://github.com/Project-OSRM/osrm-backend.
• Netlify, Inc. — hosts the static web files of the Service.

These providers process data on our behalf as needed to deliver the Service and are bound by their respective privacy policies and contractual obligations.

5.3 Legal disclosures

We may disclose information if required by law, a valid legal process, or to protect the rights, property, or safety of OtterLabs Technologies LLC, our users, or the public.

5.4 Business transfers

In the event of a merger, acquisition, or sale of company assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

5.5 No sale of personal information

We do not sell or rent your personal information to third parties for monetary or other valuable consideration. We do not "share" personal information for cross-context behavioral advertising as defined under the California Privacy Rights Act (CPRA).

6. Data Retention

We retain your account and team data for as long as your team and account remain active. You can delete your data through the Service:

• Individual records (clients, referrals, mileage days, member hours entries, etc.) can be deleted from within the app at any time. Mileage routes go to a 7-day trash before being permanently deleted; everything else is removed immediately.
• Team Owners can delete an entire team and all of its data.
• You can leave a team at any time. Records you contributed remain visible to the team after you leave (so the team's history is preserved), but you no longer have access to them.
• To request deletion of all data associated with your account, including authentication records, email eddyrivera@otterlabs.us. We will respond within 30 days.

Anonymized aggregate metrics (such as the total number of teams or sign-ins) may be retained indefinitely for operational purposes.

7. Data Security

We use industry-standard safeguards to protect your data:

• All traffic between your browser and our cloud infrastructure is encrypted in transit using TLS.
• Authentication is delegated to Google and Microsoft, both of which support multi-factor authentication on the account level.
• Stored data is protected by Firestore's server-side encryption at rest and our Firestore security rules, which enforce that only authenticated members of a team can read or write that team's data.
• Role-based access within a team further restricts who can change roles, grant section visibility, and remove members.
• OAuth access tokens for Google Sheets are held in browser memory only and are not stored at rest.

No method of transmission or storage on the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Your Rights

8.1 California residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know. You can request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we have shared it.
• Right to delete. You can request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to correct. You can request that we correct inaccurate personal information we maintain about you.
• Right to limit use of sensitive personal information. Where applicable.
• Right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of.
• Right to non-discrimination. We will not discriminate against you for exercising these rights.

To exercise any of these rights, email eddyrivera@otterlabs.us. We will verify your identity before fulfilling the request and respond within the timeframes required by law.

8.2 Users outside California

Depending on where you live, you may have similar rights under your local data protection laws. We will honor verified requests in accordance with applicable law.

9. Cookies and Local Storage

The Service does not set tracking cookies. It does use:

• Browser local storage to save your personal data, your active team, your theme preference, and similar settings, so the app loads instantly and works offline.
• IndexedDB (used by Firebase Firestore) to cache database content for offline use.

You can clear this local data from your browser's settings at any time. Doing so will sign you out and remove any unsynced changes.

10. Children's Privacy

The Service is intended for use by adults age 18 and older as part of their professional work. We do not knowingly collect personal information from children under 13 (in the United States) or under 16 (in jurisdictions where the higher age applies). If you believe a child has provided us with personal information, please contact us at eddyrivera@otterlabs.us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will provide a more prominent notice (for example, an in-app banner). Continued use of the Service after a change takes effect constitutes acceptance of the updated Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

OtterLabs Technologies LLC
Email: eddyrivera@otterlabs.us