Privacy Policy

Privacy Policy

Effective date: October 12, 2026

1. Who we are

Otlume ("Otlume", "we", "us") is an independently developed website platform that helps businesses publish structured, AI-readable websites. This Privacy Policy explains how we handle personal information when you use the Otlume admin console and related services (the "Service"). Otlume is currently operated by an independent developer under the Otlume brand.

2. Information we collect

• Account information: your email address, an optional display name, and your password, which we store only as a salted one-way hash (scrypt). We never store your password in plain text.
• Verification records: when you register, reset your password, or confirm a sensitive action, we create a short-lived verification record containing your email address and a keyed hash of the one-time code. These records expire within minutes and are purged within 24 hours.
• Security and usage data: your IP address is used to enforce rate limits and prevent abuse. It is held in short-lived counters that expire automatically when the rate-limit window ends. We also record your last sign-in time and the configuration changes you make to sites you manage.
• Email delivery data: to send verification and notification emails, we temporarily store the recipient address in encrypted form and delete it once the email is delivered.
• Content you provide: site configuration, text, images, and documents you upload to build and manage your websites.
• Hosting logs: our hosting providers may automatically log technical data such as IP address, browser type, and request time for security and operations.

3. How and why we use information

We use personal information to provide and secure the Service, specifically to:

• create and authenticate your account;
• send verification codes and service notifications;
• prevent fraud and abuse;
• operate, maintain, and improve the Service;
• comply with legal obligations.

Legal bases (EEA/UK):

• Performance of a contract: providing the Service to you.
• Legitimate interests: security, abuse prevention, and improving the Service.
• Legal obligation: where the law requires us to process data.

We do not use your information for advertising, and we do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

4. Data we process on behalf of our customers

Businesses that use Otlume publish websites that may collect information from their own visitors, for example contact or inquiry forms. For that data, the business is the controller and Otlume acts as a processor, handling it only on the business's instructions. Visitors should contact the relevant business to exercise their rights. Inquiry submissions do not store the visitor's IP address.

5. Service providers (sub-processors)

We rely on the following providers to run the Service. Each processes data only as needed to provide its service to us.

6. International transfers

Our providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Data retention

8. Cookies

The admin console uses only strictly necessary cookies:

We do not use advertising or third-party analytics cookies in the admin console.

9. Your rights

Depending on where you live, you may have the right to:

• access, correct, delete, or export your personal information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority.

California residents have the right to know, delete, and correct their personal information, and the right not to be discriminated against for exercising these rights.

To exercise any of these rights, contact us at the address below. We will respond within the time required by applicable law.

10. Security

We protect your information with measures including password hashing, encryption of sensitive fields, signed session cookies, rate limiting, and encrypted connections (HTTPS). No method of transmission or storage is completely secure, but we work to protect your information.

11. Children

The Service is intended for businesses and is not directed to anyone under 16. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date and, where appropriate, notify you by email or through the Service.

13. Contact

Questions or requests: xuanyuanziruo@gmail.com