Privacy policy

Forms hold some of the most personal information there is. Here is exactly what OtterFill collects, what it keeps and for how long, and who can see it.

Last updated November 4, 2026

What we collect

Forms and documents: The forms and documents you upload, the answers you give and your conversation with the assistant. They are used only to fill in your form.
Your account: If you sign in: your name, email address and sign-in details. You can read and fill in a form without an account.
Sensitive information: Forms often hold ID numbers, income or health details. We use them only to fill in your form. Fields that look sensitive are hidden in the preview until you show them.
In ChatGPT: If you use OtterFill in ChatGPT: the form's name and the answers written to the form. We never receive your form file, because ChatGPT reads it itself, and no account is needed. We don't see the rest of your ChatGPT conversation.
Payments: Payments are handled by our payment provider. We receive what you bought and a receipt reference, never your card number. In the app, Apple or Google takes the payment. For tax, the payment page asks for your billing address, and a business may add its tax ID; our payment provider keeps them with the receipt.
Server logs: Our servers note that a request happened (which page, whether it worked, how long it took), never its content, your answers or your address. A technical error may carry a reference to a form so we can find the problem.
Usage: How many AI requests were made and what they cost, never their content. A scrambled form of your IP address, which cannot be turned back into the address, to limit abuse. Your country, to show the right price.
Feedback: If you tell us whether OtterFill helped with a form: your answer and anything you write, with the app's language and whether you were signed in. It doesn't include your form, your answers or your account.
Organizations: The clients and documents that team members add, and a log of who did what and when, never the answers themselves. If an organization turns on email notifications: the email address of the assigned member from their sign-in, and extra addresses an administrator adds, which receive nothing until their owner confirms. Every email has a link to stop them.
Client links by email: If a member of an organization with a plan has us email a client the link to their form and its access code: the address the member enters, used only for that email. We keep a scrambled fingerprint of the address for 30 days to limit how many links it gets. Every email has a link to stop them.

What we keep, and for how long

Forms and documents: Deleted automatically after 7 days, or 30 days for a form you paid for. Delete them yourself at any time.
Forms from ChatGPT: Only the answers, deleted automatically after 48 hours, or right away when you ask ChatGPT to delete the form.
Organization forms: Kept for the organization's chosen period: 30, 60 or 90 days, or while its plan is in force and 90 days after it ends.
Copies sent for reading: Files sent to our AI provider to read the form are deleted together with the form.
Form structure: To read a form faster next time, we may keep its questions. Never anyone's answers.
Usage records: Counts, sizes and cost of AI requests, with a scrambled address and never any content: deleted after a year.
Feedback: Your answer and what you wrote, kept to improve OtterFill.
Server logs: Contain no answers or document contents. Kept only as long as needed to run and secure the service.
Account and billing records: Kept while your account exists, and as long as tax and accounting rules require.

Who can see a form

Your forms: Only you, signed in with your account. A form started without an account opens only through its own private link.
Organization forms: The organization's admins and the member it's assigned to.
Client links: A link opens only with its 6-digit code. Five wrong codes lock it, and a new link ends all earlier access.
What we store about links: Only scrambled fingerprints (hashes) of links, codes and access, never the codes themselves.

What we never do

Log your answers: Answers and document contents are never written to our logs.
Train on your data: Your forms and documents aren't used to train AI models.
Sell your data: We don't sell it, and we don't share it for advertising.
Submit for you: OtterFill never sends a form to an office. You submit it yourself.
Build our own security: Sign-in, passwords and payments are handled by specialist providers, not home-made code.

Who helps us run OtterFill

AI provider: OpenAI reads your form, translates it, answers your questions and finds where answers go. We ask it not to store the content, and the files we send are deleted with the form.
Sign-in: Clerk handles accounts, organizations, members and roles.
Payments: Stripe handles payments, receipts, refunds and sales tax on the website; Apple and Google handle purchases in the app.
Hosting and infrastructure: Cloud hosting, database, file storage, network protection and logging providers keep the service running.
Email: An email provider sends the notification emails and client links organizations ask for.
Inside ChatGPT: If you use OtterFill in ChatGPT, your conversation is also covered by OpenAI's own terms and privacy policy. In ChatGPT we never ask for ID numbers, card data, passwords or health information.
The law: We share data with anyone else only if the law requires it.

How we protect it

In transit and at rest: Everything travels over HTTPS. Files are stored privately, encrypted at rest, and can be downloaded only through your own form.
Little, and briefly: We keep as little as we can, for as short a time as we can, and delete it automatically.
Access: Sign-in is handled by a specialist provider and organization data is limited to that organization.
If something goes wrong: No system is perfectly safe. If a breach puts your information at real risk, we will tell you and the authorities as the law requires.

Why we use your information

To give you the service: Reading, translating and filling in the form you asked for, and handling what you bought.
To keep it safe: Limiting abuse and fixing faults, using the scrambled address and the usage records. This is our legitimate interest.
To follow the law: For example keeping tax and accounting records.
With your consent: For notification emails to an extra address, which receive nothing until its owner confirms. Withdraw it with the link in any email.

Cookies

Sign-in: Cookies from our sign-in provider keep you signed in.
Language: A cookie remembers the language you chose.
Human check: The human check may set a cookie to tell people from bots.
Statistics: No advertising cookies. Page views and loading speed are counted without cookies, and private form addresses are left out.
Demo video: The demo video plays from YouTube. Nothing loads from YouTube until you press play; from then on, YouTube may store data in your browser under Google's privacy policy.

Your choices

Delete a form: Use Delete Form on the form page. The form, your documents and the conversation are removed right away, with every copy.
Delete your account: In the OtterFill app, open Settings and choose Delete Account. On the website, open your account from your picture at the top of the page and choose Delete Account. Your account and all your forms are deleted right away, with their files; unused credits are lost. Billing records are kept as long as tax rules require. You can also ask us to do it.
Your data: Ask us for a copy of your data, to correct it, or to delete your account and what we hold about it. We reply within one month, and may ask you to confirm it is you.
More rights: In the European Union and the United Kingdom you can also ask us to limit how we use your information, object to it, take it to another service or withdraw consent. Write to us to use any of these.
California: We don't sell personal information or share it for advertising, so there is nothing to opt out of. You can still ask to see or delete what we hold.
Complaints: Tell us first and we will try to put it right. You can also complain to the Office of the Privacy Commissioner of Canada, to the Information and Privacy Commissioner for British Columbia, or to your local data protection authority.

Other things to know

Other countries: We are in Canada, and our providers may process data in the United States and other countries. Your information may be subject to the laws there. We choose providers with appropriate safeguards.
Children: OtterFill is not meant for children under 16.
Other languages: Translations of this policy are for convenience. If they differ, the English version applies.
Changes: When this policy changes in a way that matters, we update the date at the top and make it clear on the site.

Who we are

Who runs OtterFill: OtterFill is run by Yueyang Wang, an individual in Victoria, British Columbia, Canada. For the forms you fill in yourself, that person is responsible for your personal information.
How to reach us: Write to support@otterfill.com.
When an organization uses OtterFill: The organization decides what its clients' information is collected for, and OtterFill handles it on the organization's behalf. If you are a client, ask the organization first about your information.
The law we follow: We handle personal information under Canadian privacy law. People in the European Union, the United Kingdom and California also have the rights listed under Your choices.

Questions about your data?

Write to us for any privacy question or request.

support@otterfill.com